24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 88:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T423,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample b8a1a43638c3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b8a1a43638c3…. Threat score 100/100. 0/28 AV engines flagged this file. 14 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b8a1a43638c3aa60535b174037eccb242711e0ff03689cacfb9a413da5e38375","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","b8a1a43638c3aa60535b174037eccb242711e0ff03689cacfb9a413da5e38375"],"about":{"@type":"SoftwareApplication","name":"Setup.exe","applicationCategory":["peexe","executable"],"identifier":"b8a1a43638c3aa60535b174037eccb242711e0ff03689cacfb9a413da5e38375","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40a,"fixo1.2_trial.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00006792) "fixo1.2_trial.tmp" called "FindResourceW" with parameter "87340380" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "FindResourceW" with parameter "87300732" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "FindResourceW" with parameter "87459004" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "FindResourceW" with parameter "87341628" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "FindResourceW" with parameter "87309852" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "FindResourceW" with parameter "87341724" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "FindResourceW" with parameter "87310092" - (UID: 00000000-00007732) "PowerShell.exe" called "FindResourceW" with parameter "7" - (UID: 00000000-00005144) "PowerShell.exe" called "FindResourceW" with parameter "63" - (UID: 00000000-00005144) "PowerShell.exe" called "FindResourceW" with parameter "64" - (UID: 00000000-00005144)26:T403,"fixo1.2_trial.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '4309904'}" (UID: 00000000-00006792) "fixo1.2_trial.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323208'}" (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323112'}" (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323160'}" (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323256'}" (UID: 00000000-00007732) "PowerShell.exe" called "LoadResource with parameter {'hModule': '136314881', 'hResInfo': '136316128'}" (UID: 00000000-00005144) "PowerShell.exe" called "LoadResource with parameter {'hModule': '136314881', 'hResInfo': '136316160'}" (UID: 00000000-00005144) "PowerShell.exe" called "LoadResource with parameter {'hModule': '136314881', 'hResInfo': '136316176'}" (UID: 00000000-00005144)27:T5b2,Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "fixo1.2_trial.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "fixo1.2_trial.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp")28:T5da,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "fixo1.2_trial.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "fixo1.2_trial.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp")29:T782,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "fixo1.2_trial.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "fixo1.2_trial.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "fixo1.2_trial.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "FreeLibrary(wsock2) failed (%u)" (Indicator: "FreeLibrary"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp")2a:T40d,Found reference to API "CallWindowProcW" (Indicator: "CallWindowProc"; File: "fixo1.2_trial.exe") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001340.00000000.76400.00410000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00003784.00000000.76435.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004620.00000000.75523.00F20000.00000004.mdmp, 00000000-00004620.00000001.77441.00F20000.00000004.mdmp, 00000000-00004620.00000002.79363.00F20000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004716.00000000.74541.00610000.00000004.mdmp, 00000000-00004716.00000001.76462.00610000.00000004.mdmp, 00000000-00004716.00000002.78381.00610000.00000004.mdmp")2b:T984,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "is-TAP8K.tmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "is-TAP8K.tmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "is-TAP8K.tmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "is-TAP8K.tmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "AliyunWrapExe.exe.3162877572") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "AliyunWrapExe.exe.3162877572") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp")2c:Tae7,file/memory contains long string with (Indicator: "SHA384"; File: "AliyunWrapExe.exe") file/memory contains long string with (Indicator: "SHA384"; File: "InfoForSetup.exe") file/memory contains long string with (Indicator: "SHA384"; File: "is-CVQMH.tmp") file/memory contains long string with (Indicator: "SHA384"; File: "is-0APAL.tmp") file/memory contains long string with (Indicator: "SHA384"; File: "is-TAP8K.tmp") file/memory contains long string with (Indicator: "SHA384"; File: "is-O3ULR.tmp") file/memory contains long string with (Indicator: "SHA384"; File: "is-39RGO.tmp") file/memory contains long string with (Indicator: "SHA384"; File: "is-BK7J3.tmp") file/memory contains long string with (Indicator: "SHA384"; File: "is-01JHL.tmp") Found reference to "HMAC routines" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "AES-256-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "AES-192-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "AES-128-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "AES-256-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "AES-192-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "RC4-HMAC-MD5" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp")2d:Tf97,"fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-JM20Q.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\unins000.exe" "fixo1.2_trial.tmp" renamed original file"C:\ProgramData\EaseUS\Fixo\aliyun\is-N5H59.tmp" to "%ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\AliyunConfig.ini" "fixo1.2_trial.tmp" renamed original file"C:\ProgramData\EaseUS\Fixo\aliyun\is-OP58T.tmp" to "%ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\AliyunWrap.dll" "fixo1.2_trial.tmp" renamed original file"C:\ProgramData\EaseUS\Fixo\aliyun\is-RFRT8.tmp" to "%ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\AliyunWrapExe.exe" "fixo1.2_trial.tmp" renamed original file"C:\ProgramData\EaseUS\Fixo\aliyun\is-6IFE8.tmp" to "%ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\DataFile.ini" "fixo1.2_trial.tmp" renamed original file"C:\ProgramData\EaseUS\Fixo\aliyun\is-J84RD.tmp" to "%ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\InfoForSetup.exe" "fixo1.2_trial.tmp" renamed original file"C:\ProgramData\EaseUS\Fixo\aliyun\is-CVQMH.tmp" to "%ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\SetupUE.exe" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-9G5SC.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\EuDownloader.exe" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-39RGO.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\EUinApp.exe" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-5H4AU.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\EUOfficeViewer.exe" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-BK7J3.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\EuSendMessage.exe" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-1AJM7.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\EUUnZip.exe" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-RV393.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\GDIPLUS.DLL" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-I7ONJ.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\google-services.json" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-IMHHC.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\remote_config_data" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-TAP8K.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\send_dmp_with_aliyun.exe" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-222C0.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\style.css" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\config\is-D8494.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\config\FilterFolder.ini" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\config\is-BIRO4.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\config\nasconfig.ini" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\config\is-2BUL8.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\config\version.ini" "fixo1.2_trial.tmp" renamed original file"C:\ProgramData\EaseUS\Fixo\is-JKP27.tmp" to "%ALLUSERSPROFILE%\EaseUS\Fixo\config.ini" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-1T0BA.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\language\Arabic.qm" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-G2T21.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\language\Chinese.qm" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-F1E1T.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\language\ChineseTrad.qm" "fixo1.2_trial.tmp" renamed original file"C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-LLI8H.tmp" to "%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\language\Danish.qm"2e:T12ec,"PowerShell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "PowerShell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2f:T124f,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-202-001885B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-202-001885B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-204-00189030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-204-00189030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-135-0018DAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-135-0018DAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-162-0018A4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-195-00188AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-195-00188AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-161-0018A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-214-0018C439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-214-0018C439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-126-0018D490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-126-0018D490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-92-0018E950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-92-0018E950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-129-0018985C Assembly shows XOR instruction xor esi dword ptr [00190394h] in Stream UID: 00000000-00005144-33560-129-0018985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-129-0018985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-49-0018EE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-149-0018D560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-149-0018D560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-133-0018995D Assembly shows XOR instruction xor esi dword ptr [00190390h] in Stream UID: 00000000-00005144-33560-133-0018995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-133-0018995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-203-001889F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-203-001889F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-137-0018DA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-137-0018DA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-211-0018D341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-211-0018D341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-158-0018A510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-141-0018D610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-141-0018D610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-215-001892C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-215-001892C0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005144-33560-194-0018C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005144-33560-194-0018C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-198-00188E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-198-00188E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-151-0018D501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-151-0018D501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-305-00189754 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-305-00189754 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-182-00188190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-182-00188190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005144-33560-199-00187C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005144-33560-199-00187C3030:Te03,Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00001340.00000000.76400.73291000.00000004.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00001340.00000000.76400.73291000.00000004.mdmp") Found string "public key hash: sha256//%s" (Indicator: "public key"; Source: "00000000-00001340.00000000.76400.73291000.00000004.mdmp") Found string "not supported file type for private key" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "Private key does not match the certificate public key" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "Private key does not match the certificate public key" (Indicator: "public key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "file type P12 for private key not supported" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "file type ENG for private key not supported" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "unable to set private key file: '%s' type %s" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "RSA Public Key" (Indicator: "public key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "RSA Public Key (%d bits)" (Indicator: "public key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "Unable to load public key" (Indicator: "public key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "Public Key Algorithm" (Indicator: "public key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "Public Key Algorithm: %s" (Indicator: "public key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "Suite B: invalid public key algorithm" (Indicator: "public key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "unable to decode issuer public key" (Indicator: "public key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "X509v3 Private Key Usage Period" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "RSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "DSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "EC PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "ANY PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "recipientEncryptedKeys" (Indicator: "encryptedkey"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "CMS_RecipientEncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found string "encryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp")31:T5e2,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - AES Encryption32:T702,"fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "Select the language to use during the installation:" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "Setup" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "Welcome to the EaseUS Fixo Setup Wizard" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "This will install EaseUS Fixo on your computer.It is recommended that you close all other applications before continuing.C" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "License Agreement and Privacy Policy" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "Please read the following important information before continuing." - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "I &accept the agreement" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "I &do not accept the agreement" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "Accept" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "Please read the following License Agreement and Privacy Policy. You must accept the terms of this agreement before continuing with" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00007732)33:T1dda,"fixo1.2_trial.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000013010000b373100aad73f5440b7330fc1301ffffffffffffffff220000000000000030fc13010000000000000000000000000000000000000000220000c0000000000100000000000000ffffffffffffffff06e8aaea0000b373100aad73e99cf67604000000f0fb1301220000c060fc1301506af8761ae8aaeafeffffff38fc1301e3e2a37305000000100aad7371f2a27309000000405b699d54fc1301043cb473000000004cfc13010800000001000000200000005c3a40007cfc13016b3a400074fc1301b0f319053c6b4000016f4000b0f31905acfc13010a994000a0fc13010d3a40001f0000007c154100b4aa40000e2e4000216140000e000000 (UID: 00000000-00006792) "fixo1.2_trial.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006792) "fixo1.2_trial.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02cb0756cf61301226e2b7400007003000000002d6e2b74874d89602d000000ecb7a675f0f61301b1ce98009853f275b0f61301b1ce98008000000030f6130101000000b4f6130170c82c7413caab15feffffff2d000000d0ccb5752700000084f61301856a2d741c233274c4f61301f85f2d7408000000bb692c74b2692c742f4d89602d000000ecb7a67527000000d0ccb57598f613012d000000d0ccb57527000000c8f61301856a2d741c23327410f713017e8ab475ee8cb475738ab475c463ab922d000000ecb7a67527000000d0ccb575b411700348117003c463ab92d8f61301fc52f275c4f71301e084b475ec6548e6feffffff738ab475 (UID: 00000000-00006792) "fixo1.2_trial.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006792) "fixo1.2_trial.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000013010000b373100aad73f5440b73f8fa1301ffffffffffffffff2200000000000000f8fa13010000000000000000000000000000000000000000220000c0000000000100000000000000ffffffffffffffff1e02a8e90000b373100aad73e99cf67604000000b8fa1301220000c028fb1301506af8763202a8e9feffffff00fb1301e3e2a37305000000100aad7371f2a27309000000e7d18bbf1cfb1301043cb4730000000014fb13010800000001000000200000004845400044fb1301574540003cfb1301b0f33305c4a4400001ac4000b0f3330574fb1301161a410068fb1301f9444000910000007c0550009c34410022304000b98640000d000000 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000004c6f63616c650000000000000000000000000000000000000000000000000000010000000000000000010000000300000004000000010000000000000001cf6d6c0c4c43547970650000000000000000000000000000000000000000000000000000fc6a400000000000090400000c000000db2b98beb88b500060fb130124104100090400000c000000fcfa1301020000002c0000004cfb13013e304000c65240007c055000090400006d324100753241000d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074fb1301e5055000 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e03f4800132798be60fb1301f0cf38743e3040009d5240005cfb1301829640008a964000840c50000000d8760000000098fb1301f43e48000000d876e03f48004f000000 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000020798fb13010c964a0060fa1301140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e03f4800132798be60fb1301f0cf38743e3040009d5240005cfb130182964000 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006744b2798be0f0000001cfb1301404209743e3040009d52400018fb1301829640008a9640002059b4730000b3730000000074fb13013b6a4e00000006742c6b4e0001000000090000000010000000000100fffffeff0300000002000000d8210000000001000600004f (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007732)34:T75f,"netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000013f576000000000000000080000000e049a272000000004c711c0050722b74000081000000000080000000e049a27202000000a015a27268711c00eb49a27201000000a814a372885f2d74000000002cc2b20998711c00a84ba2729415a2729815a2720000000000000000fe4ba272f8009b7200001d0070711c0000000000 (UID: 00000000-00002640) "EuDownloader.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003784) "EuDownloader.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002760) "PowerShell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067000500000523d6000078358702204887022e0063006f006e006600690067000000a0358702 (UID: 00000000-00005144) "PowerShell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000b0028000000000000000a11400004cd4c908ee13f57680000000ee13f576000000000000000080000000f0621970000000006cd4c90850722b740000b0020000000080000000f062197002000000002f197088d4c908fb6219700100000080041a70885f2d74000000005b60e650b8d4c908b8641970f42e1970 (UID: 00000000-00005144)35:T5f5,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp")36:T55d,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "fixo1.2_trial.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp")37:T586,"fixo1.2_trial.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "fixo1.2_trial.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "InfoForSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "InfoForSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AliyunWrapExe.Exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "EUinApp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Fixo.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Fixo.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "netsh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SetupUE.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")38:T6f5,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp")39:T5ee,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "fixo1.2_trial.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "InfoForSetup.exe.3585827964") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp")3a:T5f5,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp")3b:T50c,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "fixo1.2_trial.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "fixo1.2_trial.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "fixo1.2_trial.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004716.00000000.74541.00610000.00000004.mdmp") Found reference to API "10507650388,4756,3024,,RtlGetVersion,NTDLL.dll,"00:19:24.640",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004716.00000000.74541.00610000.00000004.mdmp")3c:Te5f,"fixo1.2_trial.tmp" queries volume information of "C:\" at 00000000-00007732-00000C15-155131851 "fixo1.2_trial.tmp" queries volume information of "C:\" at 00000000-00007732-00000C15-155554934 "fixo1.2_trial.tmp" queries volume information of "C:\" at 00000000-00007732-00000C15-155641129 "Fixo.exe" queries volume information of "C:\ProgramData\EaseUS\Fixo\config.ini" at 00000000-00004716-00000C15-161556782 "Fixo.exe" queries volume information of "C:\ProgramData\EaseUS\Fixo\config.ini" at 00000000-00004716-00000C15-161558009 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\platforms\qminimal.dll" at 00000000-00004716-00000C15-161881336 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\platforms\qoffscreen.dll" at 00000000-00004716-00000C15-161889480 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\platforms\qwindows.dll" at 00000000-00004716-00000C15-161896793 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\imageformats\qgif.dll" at 00000000-00004716-00000C15-164143359 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\English.qm" at 00000000-00004716-00000C15-165167475 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\qtbase_en.qm" at 00000000-00004716-00000C15-165177713 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\style.css" at 00000000-00004716-00000C15-166053681 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\btn_close_nor.png" at 00000000-00004716-00000C15-188374289 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\btn_close_nor.png" at 00000000-00004716-00000C15-188378192 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\btn_close_dis.png" at 00000000-00004716-00000C15-188383229 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\Video\ico_right_1.png" at 00000000-00004716-00000C15-194030190 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\Video\ico_right_1.png" at 00000000-00004716-00000C15-194031197 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\Video\ico_right_2.png" at 00000000-00004716-00000C15-194036931 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\photo\ico_right_3.png" at 00000000-00004716-00000C15-195495122 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\photo\ico_Photo_dis.png" at 00000000-00004716-00000C15-195738976 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\photo\ico_Photo_hov.png" at 00000000-00004716-00000C15-195743340 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\photo\ico_Photo_hov.png" at 00000000-00004716-00000C15-195745257 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\photo\ico_Photo_sel.png" at 00000000-00004716-00000C15-195748746 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Repair\photo\ico_Photo_sel.png" at 00000000-00004716-00000C15-195749981 "Fixo.exe" queries volume information of "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Resource\Titlebar\Activate\titlebar_ico_pro.png" at 00000000-00004716-00000C15-1964659283d:T437,"fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "USESHORTNAME") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE\SUPPORTEDPROTOCOLS") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "APPENDPATH") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "PATH") "fixo1.2_trial.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EASEUS FIXO_IS1") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EASEUS FIXO_IS1") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "fixo1.2_trial.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIXO1.2_TRIAL.TMP")3e:T478,"PowerShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "PowerShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "PowerShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "PowerShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "PowerShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "PowerShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "PowerShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "PowerShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "PowerShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "PowerShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "PowerShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")3f:T660,"PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E"; Key: "BLOB") "PowerShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB")40:Tcd9,"fixo1.2_trial.exe" called "CreateDirectoryW" with parameter %TEMP%\is-VH06N.tmp (UID: 00000000-00006792) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-167V6.tmp (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-167V6.tmp\_isetup (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\EaseUS (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\aliyun (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\config (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\language (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\VideoFileRepairer (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Arabic (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Arabic\images (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Chinese (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Chinese\images (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\ChineseTrad (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\ChineseTrad\images (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Danish (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Danish\images (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Deutsch (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Deutsch\images (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Dutch (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\Dutch\images (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\EaseUS\Fixo\InnerBuyRSS\English (UID: 00000000-00007732)41:Td1e,"fixo1.2_trial.exe" called "CreateProcessW" with parameter ""%TEMP%\is-VH06N.tmp\fixo1.2_trial.tmp" /SL5="$903A6 47985566 199168 C:\fixo1.2_trial.exe"" - (UID: 00000000-00006792) "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%TEMP%\is-167V6.tmp\InfoForSetup.exe" /SendInfo "Window" "Langsel" "Activity" "Click_Confirm" "Attri" - (UID: 00000000-00007732), "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%TEMP%\is-167V6.tmp\InfoForSetup.exe" /SendInfo "Window" "Setup" "Activity" "Click_Next"" - (UID: 00000000-00007732), "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%TEMP%\is-167V6.tmp\InfoForSetup.exe" /SendInfo "Window" "Licenseagreement" "Activity" "Click_Accept" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%TEMP%\is-167V6.tmp\InfoForSetup.exe" /SendInfo "Window" "Selectdestinationlocation" "Activity" "Cli" - (UID: 00000000-00007732), "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%TEMP%\is-167V6.tmp\InfoForSetup.exe" /SendInfo "Window" "Selectadditionaltasks" "Activity" "Click_I" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\EUinApp.exe" Fixo.exe" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.easeus.com/thankyou/install-fixo.html" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\Fixo.exe"" - (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%TEMP%\is-167V6.tmp\InfoForSetup.exe" /SendInfo "Window" "Install" "Activity" "Click_Finish" "Attrib" - (UID: 00000000-00007732), "fixo1.2_trial.tmp" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\SetupUE.exe" /Enable "{\"Language\":\"en\",\"Version\":\"Trial\",\"Version_Num\":\"1.2.0.0\",\"" - (UID: 00000000-00007732), "Fixo.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\EuinApp.exe" Fixo.exe" - (UID: 00000000-00004716), "Fixo.exe" called "CreateProcessW" with parameter "/SendInfo Window "Load" Activity "Info_Wmic_Diskdrive" Attribute "[\"Availability BytesPerSector Capabilities CapabilityDescri" - (UID: 00000000-00004716), "Fixo.exe" called "CreateProcessW" with parameter "PowerShell "Get-PhysicalDisk | Format-Table -AutoSize"" - (UID: 00000000-00004716), "Fixo.exe" called "CreateProcessW" with parameter "/SendInfo Window "Promotion" Source "Exit" Activity "Result_Download" Attribute "{\"Elapsed\":\"18\",\"Error\":\"0\",\"Result\":\" - (UID: 00000000-00004716) "Fixo.exe" called "CreateProcessW" with parameter "/SendInfo Window "Load" Activity "Info_Powershell_Getphysicaldisk" Attribute "[\"The specified drive root _Z_/_ either does not e" - (UID: 00000000-00004716) "Fixo.exe" called "CreateProcessW" with parameter "/SendInfo Window "Load" Activity "Info_Hardware" Attribute "{\"Cpu\":\"\" \"Display\":\"(Standard monitor types) Generic Non-PnP" - (UID: 00000000-00004716) "Fixo.exe" called "CreateProcessW" with parameter "/SendInfo Window "Load" Activity "Info_User" Attribute "{\"Country\":\"United States\" \"Timezone\":\"GMT-08:00\"}"" - (UID: 00000000-00004716)42:T56c0,"fixo1.2_trial.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006792) "fixo1.2_trial.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006792) "fixo1.2_trial.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006792) "fixo1.2_trial.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006792) "fixo1.2_trial.exe" called "LoadLibrary" with a parameter C:\fixo1.2_trial.ENU (UID: 00000000-00006792) "fixo1.2_trial.exe" called "LoadLibrary" with a parameter C:\fixo1.2_trial.EN (UID: 00000000-00006792) "fixo1.2_trial.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00006792) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %TEMP%\is-VH06N.tmp\fixo1.2_trial.ENU (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %TEMP%\is-VH06N.tmp\fixo1.2_trial.EN (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\MSFTEDIT.DLL (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00007732) "fixo1.2_trial.tmp" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00007732) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000660) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000660) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000660) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000660) "InfoForSetup.exe" called "LoadLibrary" with a parameter %TEMP%\is-167V6.tmp\AliyunWrap.DLL (UID: 00000000-00000660) "AliyunWrapExe.Exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006744) "AliyunWrapExe.Exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006744) "AliyunWrapExe.Exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006744) "AliyunWrapExe.Exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006744) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006788) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006788) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006788) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006788) "InfoForSetup.exe" called "LoadLibrary" with a parameter %TEMP%\is-167V6.tmp\AliyunWrap.DLL (UID: 00000000-00006788) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006296) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006296) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006296) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006296) "InfoForSetup.exe" called "LoadLibrary" with a parameter %TEMP%\is-167V6.tmp\AliyunWrap.DLL (UID: 00000000-00006296) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002180) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002180) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002180) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002180) "InfoForSetup.exe" called "LoadLibrary" with a parameter %TEMP%\is-167V6.tmp\AliyunWrap.DLL (UID: 00000000-00002180) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007956) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007956) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007956) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007956) "InfoForSetup.exe" called "LoadLibrary" with a parameter %TEMP%\is-167V6.tmp\AliyunWrap.DLL (UID: 00000000-00007956) "EUinApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001036) "EUinApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001036) "EUinApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001036) "EUinApp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001036) "Fixo.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\platforms\qwindows.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHCore.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\imageformats\qjpeg.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwrite.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004716) "Fixo.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004716) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006104) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006104) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006104) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006104) "InfoForSetup.exe" called "LoadLibrary" with a parameter %TEMP%\is-167V6.tmp\AliyunWrap.DLL (UID: 00000000-00006104) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002640) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00002640) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00002640) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002640) "SetupUE.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007432) "SetupUE.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007432) "SetupUE.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007432) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005868) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005868) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005868) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005868) "InfoForSetup.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\AliyunWrap.DLL (UID: 00000000-00005868) "AliyunWrapExe.Exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004620) "AliyunWrapExe.Exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004620) "AliyunWrapExe.Exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004620) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003568) "firebasefetch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001340) "firebasefetch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001340) "firebasefetch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001340) "firebasefetch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001340) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008104) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008104) "EuDownloader.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003784) "EuDownloader.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00003784) "EuDownloader.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00003784) "EuDownloader.exe" called "LoadLibrary" with a parameter NETAPI32.DLL (UID: 00000000-00003784) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004120) "wmic.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001900) "wmic.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001900) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001312) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001312) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001312) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001312) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006276) "InfoForSetup.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\AliyunWrap.DLL (UID: 00000000-00007628) "InfoForSetup.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\EaseUS\Fixo\aliyun\AliyunWrap.DLL (UID: 00000000-00000816) "EuDownloader.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002760) "EuDownloader.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00002760) "EuDownloader.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00002760) "EuDownloader.exe" called "LoadLibrary" with a parameter NETAPI32.DLL (UID: 00000000-00002760) "PowerShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00005144) "PowerShell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005144) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004156) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004156) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004156) "EUUnZip.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007800) "EUUnZip.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007800) "EUUnZip.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007800) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003068) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003068) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002812) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002812) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002812) "InfoForSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002812) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007032) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007504) "InfoForSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007504)43:T667,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "fixo1.2_trial.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "AliyunWrapExe.exe.3162877572") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "Icmp6CreateFile" (Indicator: "CreateFile"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateFile"; Source: "00000000-00004620.00000002.79363.04DD0000.00000004.mdmp") Found reference to API "Native.CreateFile_String lp" (Indicator: "CreateFile"; Source: "00000000-00004620.00000002.79363.058E0000.00000004.mdmp")44:T1565e,Found reference to API (Indicator: "GetLongPathNameW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetDllDirectoryW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetSearchPathMode"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SysFreeString"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SysReAllocStringLen"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "RegCloseKey"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetKeyboardType"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "LoadStringW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "MessageBoxA"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "CharNextW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetACP"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "Sleep"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "VirtualFree"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetTickCount"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetVersion"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "VirtualQuery"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "lstrlenW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "lstrcpynW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetProcAddress"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "FreeLibrary"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "FindClose"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "ExitProcess"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "WriteFile"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "RtlUnwind"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "RaiseException"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetStdHandle"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "CloseHandle"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "TlsSetValue"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "TlsGetValue"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "LocalAlloc"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "TranslateMessage"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "PeekMessageW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "MessageBoxW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "DestroyWindow"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "VirtualProtect"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SizeofResource"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SignalObjectAndWait"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetLastError"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetFilePointer"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetEvent"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetErrorMode"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "ResetEvent"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "ReadFile"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "LockResource"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "LoadResource"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetVersionExW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetLastError"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetFileSize"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetCPInfo"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "FormatMessageW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "FindResourceW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "EnumCalendarInfoW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "DeleteFileW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "CreateProcessW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "CreateFileW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "CreateEventW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "fixo1.2_trial.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00005144.00000000.77917.00181000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00005144.00000000.77917.00181000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00005144.00000000.77917.00181000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "EncodePointer"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetActiveWindow"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetProcessWindowStation"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "FlsAlloc"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "FlsGetValue"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "FlsSetValue"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "FlsFree"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "URLDownloadToFileW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetAdaptersInfo"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "UuidCreate"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetUserNameW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "LookupAccountNameW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "IsValidSid"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetSidSubAuthority"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "OpenEventW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "CreateMutexW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "TerminateProcess"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetPrivateProfileIntW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetLocalTime"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "IsDebuggerPresent"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetStartupInfoW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "HeapFree"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "HeapAlloc"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "TlsAlloc"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "TlsFree"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "InterlockedIncrement"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "InterlockedDecrement"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetModuleFileNameA"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "SetHandleCount"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetFileType"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "DeleteCriticalSection"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "HeapCreate"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetCurrentProcessId"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetOEMCP"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "IsValidCodePage"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "LCMapStringW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "LeaveCriticalSection"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "EnterCriticalSection"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "HeapReAlloc"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "HeapSize"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "LoadLibraryA"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "LCMapStringA"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetStringTypeA"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetStringTypeW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetLocaleInfoA"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetConsoleCP"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetConsoleMode"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "SetStdHandle"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "WriteConsoleA"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "WriteConsoleW"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "CreateFileA"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "FlushFileBuffers"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "ReleaseMutex"; File: "AliyunWrapExe.exe.3162877572") Found reference to API (Indicator: "GetLastActivePopup"; File: "InfoForSetup.exe.3585827964") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "InfoForSetup.exe.3585827964") Found reference to API (Indicator: "InitializeCriticalSection"; File: "InfoForSetup.exe.3585827964") Found reference to API (Indicator: "LocalFree"; File: "InfoForSetup.exe.3585827964") Found reference to API (Indicator: "CommandLineToArgvW"; File: "InfoForSetup.exe.3585827964") Found reference to API (Indicator: "IsWow64Process"; File: "is-OTOUH.tmp.3678773323") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp, 00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001900.00000000.77198.00161000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001900.00000000.77198.00161000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001900.00000000.77198.00161000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001900.00000000.77198.00161000.00000020.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00001900.00000000.77198.00161000.00000020.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00001900.00000000.77198.00161000.00000020.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00001900.00000000.77198.00161000.00000020.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00001900.00000000.77198.00161000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "getservbyname"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "gethostbyname"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Heap32ListNext"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Heap32ListFirst"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Heap32Next"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Heap32First"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "NetStatisticsGet"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FlushConsoleInputBuffer"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleInputA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003784.00000000.76435.03310000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003784.00000000.76435.03310000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "URLDownloadToFileW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersInfo"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp")45:T41c,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "fixo1.2_trial.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "InfoForSetup.exe.3585827964") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp")46:T668,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "fixo1.2_trial.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "fixo1.2_trial.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001320.00000000.77202.009DA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001340.00000000.76400.6FB27000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001900.00000000.77198.001A9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004620.00000001.77441.01365000.00000002.mdmp, 00000000-00004620.00000002.79363.721E6000.00000002.mdmp")47:Ta6f,"is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_charWidthN@20" at ordinal 1 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_charsWidthN@28" at ordinal 2 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_destroyFontN@16" at ordinal 3 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_destroyN@16" at ordinal 4 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_getFontFamilyAndStyleN@20" at ordinal 5 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_initN@8" at ordinal 6 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_loadFontN@24" at ordinal 7 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_resolveFontN@16" at ordinal 8 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_stringWidthN@20" at ordinal 9 "is-39U8I.tmp" contains export function called "Java_java_awt_BDFontMetrics_unloadFontConfigN@8" at ordinal 10 "is-39U8I.tmp" contains export function called "Java_java_awt_BDGraphics_drawStringN@32" at ordinal 11 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_cacheBdRomFileN@24" at ordinal 12 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_getAacsDataN@20" at ordinal 13 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_getBdjoN@20" at ordinal 14 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_getPlaylistInfoN@20" at ordinal 15 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_getTitleInfosN@16" at ordinal 16 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_getUOMaskN@16" at ordinal 17 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_listBdFilesN@24" at ordinal 18 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_readGPRN@20" at ordinal 19 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_readPSRN@20" at ordinal 20 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_seekN@32" at ordinal 21 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_selectAngleN@20" at ordinal 22 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_selectPlaylistN@36" at ordinal 23 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_selectRateN@24" at ordinal 24 "is-39U8I.tmp" contains export function called "Java_org_videolan_Libbluray_selectTitleN@20" at ordinal 2548:Ta25,"SOFTWARE\Borland\Delphi\RTL" in Source: fixo1.2_trial.exe "Software\CodeGear\Locales" in Source: fixo1.2_trial.exe "Software\Borland\Locales" in Source: fixo1.2_trial.exe "Software\Borland\Delphi\Locales" in Source: fixo1.2_trial.exe "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 33560-182-00188190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 33560-182-00188190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 33560-182-00188190 "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 33560-149-0018D560 "SOFTWARE\Microsoft\PowerShell" in Source: 33560-195-00188AF0 "SOFTWARE\Microsoft\PowerShell\3" in Source: 33560-184-0018BFA2 "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 35294-358-004056F0 "HARDWARE\DESCRIPTION\System" in Source: 35294-360-004056B0 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 46623-185-00495FD0 "Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 46623-185-00495FD0 "SOFTWARE\Wondershare\Repairit" in Source: 46623-185-00495FD0 "SOFTWARE\EaseUS\Fixo\Language" in Source: 46623-488-0054A230 "SOFTWARE\EASEUS\Fixo\Language" in Source: 46623-410-00496EA0 "SOFTWARE\EASEUS\Fixo\Version" in Source: 46623-410-00496EA0 "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\Ftp\UserChoice\" in Source: 46623-410-00496EA0 "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00001900.00000000.77198.00161000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004620.00000000.75523.00F20000.00000004.mdmp 00000000-00004620.00000001.77441.00F20000.00000004.mdmp 00000000-00004620.00000002.79363.00F20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004620.00000000.75523.00F20000.00000004.mdmp 00000000-00004620.00000001.77441.00F20000.00000004.mdmp 00000000-00004620.00000002.79363.00F20000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00004620.00000001.77441.00F20000.00000004.mdmp 00000000-00004620.00000002.79363.00F20000.00000004.mdmp "HARDWARE\DESCRIPTION\System" in Source: 00000000-00004620.00000001.77441.01365000.00000002.mdmp 00000000-00004620.00000002.79363.721E6000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004620.00000001.77441.01365000.00000002.mdmp 00000000-00004620.00000002.79363.721E6000.00000002.mdmp "SOFTWARE\EASEUS\Fixo\ExitShowHelp" in Source: 00000000-00004716.00000000.74541.01002000.00000002.mdmp49:T42b,Antivirus vendors marked dropped file "is-B0OO6.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-39U8I.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "is-EBD0B.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-NU2C4.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-OTOUH.tmp" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-5H4AU.tmp" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-5ORPV.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "AliyunWrap.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")4a:T872,"fixo1.2_trial.tmp" failed to load missing module "%WINDIR%\System32\Windows.UI.AppDefaults.dll" - [base:0; Status:c0000135] "AliyunWrapExe.Exe" failed to load missing module "phoneinfo.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "PowerShell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135]4b:T4fd,"GET /product/index.php?c=main&a=getstatus&pid=0 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: track.easeus.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sat 11 Nov 2023 18:37:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 21 Connection: keep-alive Server: Apache Content-Encoding: gzip X-Via: 1.1 VM-SEA-01mSI27:2 (Cdn Cache Server V2.0) X-Ws-Request-Id: 654fc9f4_VM-SEA-01mSI27_15323-31409 with response body ==>....... "GET /product/index.php?c=main&a=getstatus&pid=0 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: track.easeus.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sat 11 Nov 2023 18:39:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 21 Connection: keep-alive Server: Apache Content-Encoding: gzip X-Via: 1.1 hx183:13 (Cdn Cache Server V2.0) X-Ws-Request-Id: 654fca69_PS-SJC-019DC182_15039-46290 with response body ==>.......4c:T506,Launches browser "msedge.exe" (UID: 00000000-00002144) Launches browser "msedge.exe" (UID: 00000000-00004132) Launches browser "msedge.exe" (UID: 00000000-00007120) Launches browser "msedge.exe" (UID: 00000000-00006252) Launches browser "msedge.exe" (UID: 00000000-00005936) Launches browser "msedge.exe" (UID: 00000000-00007188) Launches browser "msedge.exe" (UID: 00000000-00005940) Launches browser "msedge.exe" (UID: 00000000-00006956) Launches browser "msedge.exe" (UID: 00000000-00008032) Launches browser "msedge.exe" (UID: 00000000-00006692) Launches browser "msedge.exe" (UID: 00000000-00002208) Launches browser "msedge.exe" (UID: 00000000-00002712) Launches browser "msedge.exe" (UID: 00000000-00002736) Launches browser "msedge.exe" (UID: 00000000-00003536) Launches browser "msedge.exe" (UID: 00000000-00003924) Launches browser "msedge.exe" (UID: 00000000-00004964) Launches browser "msedge.exe" (UID: 00000000-00006192) Launches browser "msedge.exe" (UID: 00000000-00006800) Launches browser "msedge.exe" (UID: 00000000-00007868) Launches browser "msedge.exe" (UID: 00000000-00008180) Launches browser "msedge.exe" (UID: 00000000-00001604) Launches browser "msedge.exe" (UID: 00000000-00001676) Launches browser "msedge.exe" (UID: 00000000-00006708)4d:T51db,"fixo1.2_trial.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "fixo1.2_trial.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "fixo1.2_trial.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "fixo1.2_trial.exe" loaded module "KERNEL32" at base 73b30000 "fixo1.2_trial.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "fixo1.2_trial.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75a40000 "fixo1.2_trial.exe" loaded module "COMCTL32.DLL" at base 730f0000 "fixo1.2_trial.exe" loaded module "KERNEL32.DLL" at base 73b30000 "fixo1.2_trial.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733b0000 "fixo1.2_trial.exe" loaded module "NTDLL.DLL" at base 76f10000 "fixo1.2_trial.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73880000 "fixo1.2_trial.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "fixo1.2_trial.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "fixo1.2_trial.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "fixo1.2_trial.tmp" loaded module "KERNEL32" at base 73b30000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "fixo1.2_trial.tmp" loaded module "IMM32.DLL" at base 74030000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733b0000 "fixo1.2_trial.tmp" loaded module "KERNEL32.DLL" at base 73b30000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75a40000 "fixo1.2_trial.tmp" loaded module "OLEAUT32.DLL" at base 748e0000 "fixo1.2_trial.tmp" loaded module "RPCRT4.DLL" at base 73f10000 "fixo1.2_trial.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 756d0000 "fixo1.2_trial.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 756d0000 "fixo1.2_trial.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74330000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 758f0000 "fixo1.2_trial.tmp" loaded module "COMCTL32" at base 730f0000 "fixo1.2_trial.tmp" loaded module "COMCTL32.DLL" at base 730f0000 "fixo1.2_trial.tmp" loaded module "UXTHEME.DLL" at base 733b0000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76d80000 "fixo1.2_trial.tmp" loaded module "DWMAPI.DLL" at base 72a80000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72a80000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72640000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 72610000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74fc0000 "fixo1.2_trial.tmp" loaded module "SHELL32.DLL" at base 75a40000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 74f70000 "fixo1.2_trial.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72530000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\MSFTEDIT.DLL" at base 72280000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 72140000 "fixo1.2_trial.tmp" loaded module "USER32.DLL" at base 756d0000 "fixo1.2_trial.tmp" loaded module "NTDLL.DLL" at base 76f10000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73880000 "fixo1.2_trial.tmp" loaded module "SSPICLI.DLL" at base 73930000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 71260000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 3220000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74980000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72e80000 "fixo1.2_trial.tmp" loaded module "CSCAPI.DLL" at base 72c40000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 71070000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75a40000 "fixo1.2_trial.tmp" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 73b30000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 71eb0000 "fixo1.2_trial.tmp" loaded module "MSISO.DLL" at base 71c30000 "fixo1.2_trial.tmp" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 73950000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74980000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 70d90000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 70d70000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 70200000 "fixo1.2_trial.tmp" loaded module "PROPSYS.DLL" at base 72e80000 "fixo1.2_trial.tmp" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74330000 "fixo1.2_trial.tmp" loaded module "SECUR32.DLL" at base 701b0000 "fixo1.2_trial.tmp" loaded module "MLANG.DLL" at base 70170000 "fixo1.2_trial.tmp" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 74850000 "fixo1.2_trial.tmp" loaded module "WININET.DLL" at base 71960000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "InfoForSetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "InfoForSetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "InfoForSetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "InfoForSetup.exe" loaded module "KERNEL32" at base 73b30000 "InfoForSetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "InfoForSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73310000 "InfoForSetup.exe" loaded module "RPCRT4.DLL" at base 73f10000 "InfoForSetup.exe" loaded module "SSPICLI.DLL" at base 73930000 "InfoForSetup.exe" loaded module "%TEMP%\IS-167V6.TMP\ALIYUNWRAP.DLL" at base 72040000 "InfoForSetup.exe" loaded module "NTDLL.DLL" at base 76f10000 "InfoForSetup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73880000 "AliyunWrapExe.Exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "AliyunWrapExe.Exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "AliyunWrapExe.Exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "AliyunWrapExe.Exe" loaded module "KERNEL32" at base 73b30000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "AliyunWrapExe.Exe" loaded module "KERNEL32.DLL" at base 73b30000 "AliyunWrapExe.Exe" loaded module "USER32.DLL" at base 756d0000 "AliyunWrapExe.Exe" loaded module "MSISO.DLL" at base 71c30000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733b0000 "AliyunWrapExe.Exe" loaded module "PHONEINFO.DLL" at base 0 "AliyunWrapExe.Exe" loaded module "RPCRT4.DLL" at base 73f10000 "AliyunWrapExe.Exe" loaded module "SSPICLI.DLL" at base 73930000 "AliyunWrapExe.Exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 71940000 "AliyunWrapExe.Exe" loaded module "WINHTTP.DLL" at base 71890000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71940000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73310000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71870000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71820000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76ea0000 "EUinApp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "EUinApp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "EUinApp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "EUinApp.exe" loaded module "KERNEL32" at base 73b30000 "EUinApp.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "Fixo.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "Fixo.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "Fixo.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "Fixo.exe" loaded module "KERNEL32" at base 73b30000 "Fixo.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "Fixo.exe" loaded module "SECUR32.DLL" at base 701b0000 "Fixo.exe" loaded module "IPHLPAPI.DLL" at base 73850000 "Fixo.exe" loaded module "NTDLL.DLL" at base 76f10000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75a40000 "Fixo.exe" loaded module "KERNEL32.DLL" at base 73b30000 "Fixo.exe" loaded module "%PROGRAMFILES%\(X86)\EASEUS\EASEUS FIXO\PLATFORMS\QWINDOWS.DLL" at base 6f500000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733b0000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 74850000 "Fixo.exe" loaded module "%PROGRAMFILES%\(X86)\EASEUS\EASEUS FIXO\IMAGEFORMATS\QJPEG.DLL" at base 725c0000 "Fixo.exe" loaded module "PSAPI" at base 73e50000 "Fixo.exe" loaded module "RPCRT4.DLL" at base 73f10000 "Fixo.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 73950000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71630000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73300000 "Fixo.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 73950000 "Fixo.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 73950000 "Fixo.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 73950000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72e80000 "Fixo.exe" loaded module "SHELL32.DLL" at base 75a40000 "Fixo.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72930000 "Fixo.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75a40000 "Fixo.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 71eb0000 "Fixo.exe" loaded module "SSPICLI.DLL" at base 73930000 "Fixo.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 73950000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74980000 "Fixo.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6e990000 "Fixo.exe" loaded module "D3D10WARP.DLL" at base 6e430000 "Fixo.exe" loaded module "GDI32.DLL" at base 75870000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\DWRITE.DLL" at base 71200000 "Fixo.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 758f0000 "Fixo.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 74850000 "Fixo.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72550000 "Fixo.exe" loaded module "WS2_32.DLL" at base 76ea0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74030000 "netsh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "netsh.exe" loaded module "MPRAPI.DLL" at base 6f480000 "netsh.exe" loaded module "MSVCRT.DLL" at base 74270000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 72630000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 73100000 "netsh.exe" loaded module "RPCRT4.DLL" at base 73f10000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 723f0000 "netsh.exe" loaded module "WHHELPER.DLL" at base 72650000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 720c0000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74330000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 748e0000 "SetupUE.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "SetupUE.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "SetupUE.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "SetupUE.exe" loaded module "NTDLL.DLL" at base 76f10000 "InfoForSetup.exe" loaded module "%ALLUSERSPROFILE%\EASEUS\FIXO\ALIYUN\ALIYUNWRAP.DLL" at base 72180000 "EuinApp.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "firebasefetch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "firebasefetch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "firebasefetch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "firebasefetch.exe" loaded module "SECUR32.DLL" at base 701b0000 "firebasefetch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73310000 "firebasefetch.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 73950000 "firebasefetch.exe" loaded module "SSPICLI.DLL" at base 73930000 "firebasefetch.exe" loaded module "MSKEYPROTECT.DLL" at base 72210000 "firebasefetch.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 71690000 "firebasefetch.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74fc0000 "firebasefetch.exe" loaded module "WS2_32.DLL" at base 76ea0000 "EuDownloader.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "EuDownloader.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "EuDownloader.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "EuDownloader.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73310000 "EuDownloader.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71870000 "EuDownloader.exe" loaded module "ADVAPI32.DLL" at base 74060000 "EuDownloader.exe" loaded module "KERNEL32.DLL" at base 73b30000 "EuDownloader.exe" loaded module "NETAPI32.DLL" at base 701c0000 "EuDownloader.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 717d0000 "wmic.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "wmic.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "wmic.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 732b0000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73300000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 729c0000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 71670000 "wmic.exe" loaded module "AMSI.DLL" at base 72200000 "EuDownloader.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "EuDownloader.exe" loaded module "KERNEL32" at base 73b30000 "PowerShell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "PowerShell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "PowerShell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "PowerShell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "PowerShell.exe" loaded module "ADVAPI32.DLL" at base 74060000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71170000 "PowerShell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74580000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 6db60000 "PowerShell.exe" loaded module "USER32.DLL" at base 756d0000 "PowerShell.exe" loaded module "MSCOREE.DLL" at base 72120000 "PowerShell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74330000 "PowerShell.exe" loaded module "PSAPI.DLL" at base 73e50000 "PowerShell.exe" loaded module "KERNEL32.DLL" at base 73b30000 "PowerShell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6c750000 "PowerShell.exe" loaded module "RPCRT4.DLL" at base 73f10000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "PowerShell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74330000 "PowerShell.exe" loaded module "OLEAUT32.DLL" at base 748e0000 "PowerShell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73950000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71000000 "PowerShell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 717d0000 "PowerShell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6b4d0000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "PowerShell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 74330000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "PowerShell.exe" loaded module "NTDLL.DLL" at base 76f10000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "PowerShell.exe" loaded module "SHELL32.DLL" at base 75a40000 "PowerShell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72100000 "PowerShell.exe" loaded module "WINTRUST.DLL" at base 73ec0000 "PowerShell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 70f80000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "PowerShell.exe" loaded module "VERSION.DLL" at base 73650000 "PowerShell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 73ec0000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "PowerShell.exe" loaded module "CRYPT32.DLL" at base 740e0000 "PowerShell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 74330000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "PowerShell.exe" loaded module "SECUR32.DLL" at base 701b0000 "PowerShell.exe" loaded module "SSPICLI.DLL" at base 73930000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "PowerShell.exe" loaded module "SHLWAPI.DLL" at base 74f70000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "PowerShell.exe" loaded module "WLDP.DLL" at base 720e0000 "PowerShell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733b0000 "PowerShell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73650000 "PowerShell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6a950000 "PowerShell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 73b30000 "PowerShell.exe" loaded module "USERENV.DLL" at base 6fa90000 "PowerShell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74060000 "PowerShell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 72200000 "PowerShell.exe" loaded module "OLE32.DLL" at base 76d80000 "PowerShell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 70190000 "PowerShell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 73b30000 "PowerShell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6a920000 "PowerShell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 71160000 "PowerShell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71780000 "PowerShell.exe" loaded module "CRYPTNET.DLL" at base 71780000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "PowerShell.exe" loaded module "URLMON.DLL" at base 71eb0000 "PowerShell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 73950000 "PowerShell.exe" loaded module "MSISO.DLL" at base 71c30000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6a720000 "PowerShell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6a610000 "PowerShell.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 73b30000 "EUUnZip.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73950000 "EUUnZip.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73950000 "EUUnZip.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73950000 "EUUnZip.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73050000 "EUUnZip.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733b00004e:T46f,"fixo1.2_trial.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "fixo1.2_trial.tmp" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C50000 "InfoForSetup.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "AliyunWrapExe.Exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C50000 "EUinApp.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "Fixo.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "Fixo.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C50000 "netsh.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "SetupUE.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "EuinApp.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "EuDownloader.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C50000 "wmic.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC00004f:T617,"fixo1.2_trial.exe" was detected as "Inno Setup Module" and name: "Installer" "fixo1.2_trial.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "fixo1.2_trial.exe" was detected as "Turbo Linker" and name: "Linker" "AliyunWrapExe.exe" was detected as "Inno Setup Module" and name: "Installer" "AliyunWrapExe.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "AliyunWrapExe.exe" was detected as "Turbo Linker" and name: "Linker" "InfoForSetup.exe" was detected as "Inno Setup Module" and name: "Installer" "InfoForSetup.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "InfoForSetup.exe" was detected as "Turbo Linker" and name: "Linker" "is-39U8I.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-39U8I.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-39U8I.tmp" was detected as "Turbo Linker" and name: "Linker" "is-NU2C4.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-NU2C4.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-NU2C4.tmp" was detected as "Turbo Linker" and name: "Linker" "is-5H4AU.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-5H4AU.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-5H4AU.tmp" was detected as "Turbo Linker" and name: "Linker" "is-5ORPV.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-5ORPV.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-5ORPV.tmp" was detected as "Turbo Linker" and name: "Linker"50:T10c3,"fixo1.2_trial.tmp" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "fixo1.2_trial.tmp" touched "Internet Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TREATAS") "fixo1.2_trial.tmp" touched "Microsoft Url History Service" (Path: "HKCU\WOW6432NODE\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "fixo1.2_trial.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "fixo1.2_trial.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "fixo1.2_trial.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "fixo1.2_trial.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "fixo1.2_trial.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "fixo1.2_trial.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "fixo1.2_trial.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "fixo1.2_trial.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "fixo1.2_trial.tmp" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "fixo1.2_trial.tmp" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "fixo1.2_trial.tmp" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "fixo1.2_trial.tmp" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "fixo1.2_trial.tmp" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Fixo.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "Fixo.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "Fixo.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "Fixo.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "Fixo.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\LOCALSERVER") "Fixo.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32") "Fixo.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "Fixo.exe" touched "Microsoft Web Browser" (Path: "HKCU\WOW6432NODE\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\INPROCSERVER32") "wmic.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "wmic.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\WOW6432NODE\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\INPROCSERVER32") "wmic.exe" touched "WbemQuery" (Path: "HKCU\WOW6432NODE\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "wmic.exe" touched "XSL Template 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS") "wmic.exe" touched "VB Script Language" (Path: "HKCU\WOW6432NODE\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "wmic.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "PowerShell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")51:Te2f,"AliyunWrapExe.exe" file has an entrypoint instructions - "call 0x40bd8c,jmp 0x408cff,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov edx, eax,mov cx, word ptr [eax],inc eax,inc eax,test cx, cx,jne 0x408e90,mov cx, word ptr [ebp + 0xc],dec eax,dec eax,cmp eax, edx,je 0x408ea9,cmp word ptr [eax], cx,jne 0x408e9e,cmp word ptr [eax], cx,je 0x408eb0,xor eax, eax,pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,mov edx, dword ptr [ebp + 8],push ebx,push esi,push edi,xor edi, edi,cmp edx, edi,je 0x408eca,mov ebx, dword ptr [ebp + 0xc],cmp ebx, edi,ja 0x408ee8,call 0x40a137,push 0x16,pop esi,mov dword ptr [eax], esi,push edi,push edi,push edi,push edi,push edi,call 0x408c20," "InfoForSetup.exe" file has an entrypoint instructions - "call 0x404bfe,jmp 0x4026d0,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x40ddd8], eax,mov dword ptr [0x40ddd4], ecx,mov dword ptr [0x40ddd0], edx,mov dword ptr [0x40ddcc], ebx,mov dword ptr [0x40ddc8], esi,mov dword ptr [0x40ddc4], edi,mov word ptr [0x40ddf0], ss,mov word ptr [0x40dde4], cs,mov word ptr [0x40ddc0], ds,mov word ptr [0x40ddbc], es,mov word ptr [0x40ddb8], fs,mov word ptr [0x40ddb4], gs,pushfd ," "is-39U8I.tmp" file has an entrypoint instructions - "sub esp, 0x1c,mov dword ptr [0x103b5290], 0,mov edx, dword ptr [esp + 0x24],cmp edx, 1,je 0x10001410,mov ecx, dword ptr [esp + 0x28],mov eax, dword ptr [esp + 0x20],call 0x10001280,add esp, 0x1c,ret 0xc,lea esi, [esi],mov dword ptr [esp + 0xc], edx,call 0x10293cf0,mov edx, dword ptr [esp + 0xc],jmp 0x100013f6,nop ,push ebp,mov ebp, esp,sub esp, 0x18,mov dword ptr [esp], 0x10001440,call 0x10293c20,leave ,ret ,lea esi, [esi],lea edi, [edi],push ebp,mov ebp, esp,pop ebp," "is-NU2C4.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10167233,call 0x10167cbd,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x101670ff,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x10167269,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10,int3 ,int3 ,int3 ,int3 ,int3 ," "is-5H4AU.tmp" file has an entrypoint instructions - "call 0x5507ac,jmp 0x54faf8,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,bnd ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,bnd call 0x54f4e7,bnd jmp 0x54fc7e,mov ecx, dword ptr [ebp - 0x14],xor ecx, ebp,bnd call 0x54f4e7,bnd jmp 0x54fc7e,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x5cee44],xor eax, ebp,push eax,push dword ptr [ebp - 4]," "is-5ORPV.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1017208e,call 0x101723e1,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x101720a3,add esp, 0xc,pop ebp,ret 0xc,push 0x10,push 0x101c8d88,call 0x10172210,xor eax, eax,inc eax,mov esi, eax,mov dword ptr [ebp - 0x1c], esi,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,mov edi, dword ptr [ebp + 0xc],mov dword ptr [0x101f2770], edi,mov dword ptr [ebp - 4], eax,test edi, edi,jne 0x101720d8,cmp dword ptr [0x101f5390], edi,je 0x101721ac,cmp edi, eax,je 0x101720e1,cmp edi, 2,jne 0x10172119,"52:T232d,Process "fixo1.2_trial.tmp" (UID: 00000000-00007732) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "fixo1.2_trial.tmp" (UID: 00000000-00007732) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002144) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00002144) was launched with modified environment variables: "Path" Process "Fixo.exe" (UID: 00000000-00004716) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00004132) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_2144_RXBYKFDQKACKDPLU", EDGE_BROWSER_PID="2144"" Process "msedge.exe" (UID: 00000000-00004132) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004132) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "netsh.exe" (UID: 00000000-00002640) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "netsh.exe" (UID: 00000000-00002640) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "netsh.exe" (UID: 00000000-00002640) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007120) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_2144_RXBYKFDQKACKDPLU", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="2144"" Process "msedge.exe" (UID: 00000000-00007120) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007120) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "InfoForSetup.exe" (UID: 00000000-00006384) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "InfoForSetup.exe" (UID: 00000000-00006384) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "InfoForSetup.exe" (UID: 00000000-00006384) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006252) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_2144_RXBYKFDQKACKDPLU", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="2144"" Process "msedge.exe" (UID: 00000000-00006252) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006252) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "InfoForSetup.exe" (UID: 00000000-00005868) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "InfoForSetup.exe" (UID: 00000000-00005868) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "InfoForSetup.exe" (UID: 00000000-00005868) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004964) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_2144_RXBYKFDQKACKDPLU", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="2144"" Process "msedge.exe" (UID: 00000000-00004964) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004964) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "EuinApp.exe" (UID: 00000000-00004572) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "EuinApp.exe" (UID: 00000000-00004572) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "EuinApp.exe" (UID: 00000000-00004572) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00008180) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_2144_RXBYKFDQKACKDPLU", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="2144"" Process "msedge.exe" (UID: 00000000-00008180) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00008180) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "InfoForSetup.exe" (UID: 00000000-00003568) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "InfoForSetup.exe" (UID: 00000000-00003568) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "InfoForSetup.exe" (UID: 00000000-00003568) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00001604) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_2144_RXBYKFDQKACKDPLU", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="2144"" Process "msedge.exe" (UID: 00000000-00001604) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00001604) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "wmic.exe" (UID: 00000000-00001900) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "wmic.exe" (UID: 00000000-00001900) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "wmic.exe" (UID: 00000000-00001900) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006708) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_2144_RXBYKFDQKACKDPLU", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="2144"" Process "msedge.exe" (UID: 00000000-00006708) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006708) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"53:T47a,"fixo1.2_trial.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "fixo1.2_trial.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "fixo1.2_trial.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "fixo1.2_trial.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "fixo1.2_trial.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "fixo1.2_trial.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "fixo1.2_trial.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "InfoForSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AliyunWrapExe.Exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AliyunWrapExe.Exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AliyunWrapExe.Exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "EUinApp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")54:Tdcc,Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00006792-00000C25-52708576] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00007732-00000C25-53725597] Observed system executable string:"%WINDIR%\system32\shfolder.dll" [Source: 00000000-00007732-00000C25-60261803] Observed system executable string:"%WINDIR%\system32\Rstrtmgr.dll" [Source: 00000000-00007732-00000C25-60302889] Observed system executable string:"%WINDIR%\system32\shlwapi.dll" [Source: 00000000-00007732-00000C25-60826699] Observed system executable string:"%WINDIR%\system32\MSFTEDIT.DLL" [Source: 00000000-00007732-00000C25-61061402] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00007732-00000C25-135165358] Observed system executable string:"%WINDIR%\system32\SHCore.dll" [Source: 00000000-00004716-00000C25-163566087] Observed system executable string:"%WINDIR%\system32\dwrite.dll" [Source: 00000000-00004716-00000C25-188529906] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005144-00000C25-213912180] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005144-00000C25-214822644] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005144-00000C25-215499550] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005144-00000C25-215912198] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005144-00000C25-215955266] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005144-00000C25-216173465] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005144-00000C25-217487660] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005144-00000C25-218580257] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005144-00000C25-218675934] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005144-00000C25-219196610] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005144-00000C25-220090122] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005144-00000C25-220123974] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005144-00000C25-222418079] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00005144-00000C25-223547181] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" [Source: 00000000-00005144-00000C25-224039136] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00005144-00000C25-224892602]55:Tcdb,Spawned process "fixo1.2_trial.tmp" with commandline "/SL5="$903A6 47985566 199168 C:\\fixo1.2_trial.exe"" (UID: 00000000-00007732) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Langsel" "Activity" "Click_Confirm" "Attribu ..." (UID: 00000000-00000660), Spawned process "AliyunWrapExe.Exe" (UID: 00000000-00006744), Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Setup" "Activity" "Click_Next"" (UID: 00000000-00006788), Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Licenseagreement" "Activity" "Click_Accept"" (UID: 00000000-00006296), Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Selectdestinationlocation" "Activity" "Click ..." (UID: 00000000-00002180) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Selectadditionaltasks" "Activity" "Click_Ins ..." (UID: 00000000-00007956), Spawned process "EUinApp.exe" with commandline "Fixo.exe" (UID: 00000000-00001036), Spawned process "msedge.exe" with commandline "--single-argument https://www.easeus.com/thankyou/install-fixo.h ..." (UID: 00000000-00002144), Spawned process "Fixo.exe" (UID: 00000000-00004716), Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Install" "Activity" "Click_Finish" "Attribut ..." (UID: 00000000-00006104) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004132), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule action=allow profile=any pro ..." (UID: 00000000-00002640), Spawned process "SetupUE.exe" with commandline "/Enable "{\\"Language\\":\\"en\\",\\"Version\\":\\"Trial\\",\\"V ..." (UID: 00000000-00007432), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007120), Spawned process "InfoForSetup.exe" with commandline "/Enable" (UID: 00000000-00006384), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006252), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005936), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007188), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005940), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00006956), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00008032), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00006692), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00002208), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00002712)56:Tcdb,Spawned process "fixo1.2_trial.tmp" with commandline "/SL5="$903A6 47985566 199168 C:\\fixo1.2_trial.exe"" (UID: 00000000-00007732) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Langsel" "Activity" "Click_Confirm" "Attribu ..." (UID: 00000000-00000660), Spawned process "AliyunWrapExe.Exe" (UID: 00000000-00006744), Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Setup" "Activity" "Click_Next"" (UID: 00000000-00006788), Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Licenseagreement" "Activity" "Click_Accept"" (UID: 00000000-00006296), Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Selectdestinationlocation" "Activity" "Click ..." (UID: 00000000-00002180) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Selectadditionaltasks" "Activity" "Click_Ins ..." (UID: 00000000-00007956), Spawned process "EUinApp.exe" with commandline "Fixo.exe" (UID: 00000000-00001036), Spawned process "msedge.exe" with commandline "--single-argument https://www.easeus.com/thankyou/install-fixo.h ..." (UID: 00000000-00002144), Spawned process "Fixo.exe" (UID: 00000000-00004716), Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Install" "Activity" "Click_Finish" "Attribut ..." (UID: 00000000-00006104) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004132), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule action=allow profile=any pro ..." (UID: 00000000-00002640), Spawned process "SetupUE.exe" with commandline "/Enable "{\\"Language\\":\\"en\\",\\"Version\\":\\"Trial\\",\\"V ..." (UID: 00000000-00007432), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007120), Spawned process "InfoForSetup.exe" with commandline "/Enable" (UID: 00000000-00006384), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006252), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005936), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007188), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005940), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00006956), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00008032), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00006692), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00002208), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00002712)57:T4d7,The input sample is signed with a certificate issued by "OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.1.3.6.1.4.1.311.60.2.1.2=???, OID.1.3.6.1.4.1.311.60.2.1.1=???, OID.2.5.4.15=Private Organization, SERIALNUMBER=91510107765360104N, C=CN, S=???, L=???, O="CHENGDU YIWO Tech Development Co. Ltd.", CN="CHENGDU YIWO Tech Development Co. Ltd."" (SHA1: E0:44:E9:20:D5:6E:CE:15:D7:A2:1D:D0:58:65:1A:3F:21:66:CF:D6: (1.2.840.113549.1.1.11); see report for more information) The input sample is signed with a certificate issued by "C=US, O="DigiCert Inc.", CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C: (1.2.840.113549.1.1.12); see report for more information) The input sample is signed with a certificate issued by "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6: (1.2.840.113549.1.1.12); see report for more information) The input sample is signed with a certificate issued by "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA" (SHA1: 05:63:B8:63:0D:62:D7:5A:BB:C8:AB:1E:4B:DF:B5:A8:99:B2:4D:43: (sha1RSA(RSA)); see report for more information)58:T489,"fixo1.2_trial.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\fixo1.2_trial.tmp" "fixo1.2_trial.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\_isetup\_setup64.tmp" "fixo1.2_trial.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\InfoForSetup.exe" "fixo1.2_trial.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\AliyunWrapExe.exe" "fixo1.2_trial.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\AliyunWrap.dll" "fixo1.2_trial.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\AliyunConfig.ini" "fixo1.2_trial.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\DataFile.ini" "fixo1.2_trial.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\version.ini" "InfoForSetup.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\AliyunWrap.dll" "InfoForSetup.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\AliyunConfig.ini" "InfoForSetup.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\DataFile.ini"59:Tfbf,"is-KDPKS.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\VideoFileRepairer\is-KDPKS.tmp] "is-2R6IJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\VideoFileRepairer\is-2R6IJ.tmp] "is-55810.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\VideoFileRepairer\is-55810.tmp] "is-92BSR.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-92BSR.tmp] "is-EHMKP.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\VideoViewer\is-EHMKP.tmp] "is-9G7PM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-9G7PM.tmp] "is-B0OO6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-B0OO6.tmp] "is-39U8I.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\VideoViewer\is-39U8I.tmp] "is-EBD0B.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\VideoFileRepairer\is-EBD0B.tmp] "is-NU2C4.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-NU2C4.tmp] "is-OTOUH.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-OTOUH.tmp] "is-5H4AU.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-5H4AU.tmp] "is-5ORPV.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-5ORPV.tmp] "is-LCOS0.tmp" has type "GIF image data version 89a 360 x 360" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\Resource\Repair\PDF\is-LCOS0.tmp] "is-RV393.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-RV393.tmp] "is-PQRV9.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-PQRV9.tmp] "is-9G5SC.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-9G5SC.tmp] "is-V11M5.tmp" has type "GIF image data version 89a 360 x 360" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\Resource\Repair\photo\is-V11M5.tmp] "is-LD863.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\VideoFileRepairer\is-LD863.tmp] "is-68400.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-68400.tmp] "fixo1.2_trial.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%TEMP%\is-VH06N.tmp\fixo1.2_trial.tmp] "is-EC8E0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-EC8E0.tmp] "is-2TNEQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\platforms\is-2TNEQ.tmp] "is-5GGQ5.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\is-5GGQ5.tmp] "is-FF1LJ.tmp" has type "GIF image data version 89a 360 x 360" - Location: [%PROGRAMFILES%\(x86)\EaseUS\EaseUS Fixo\Resource\Repair\Video\is-FF1LJ.tmp]5a:T5ed,"fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")5b:T59a,"fixo1.2_trial.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\fixo1.2_trial.tmp" (UID: 6792) "fixo1.2_trial.tmp" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\fixo1.2_trial.tmp" (UID: 7732) "fixo1.2_trial.tmp" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\InfoForSetup.exe" (UID: 7732) "fixo1.2_trial.tmp" queries basic process information of the "C:\Program Files (x86)\EaseUS\EaseUS Fixo\EUinApp.exe" (UID: 7732) "fixo1.2_trial.tmp" queries basic process information of the "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (UID: 7732) "fixo1.2_trial.tmp" queries basic process information of the "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Fixo.exe" (UID: 7732) "fixo1.2_trial.tmp" queries basic process information of the "C:\ProgramData\EaseUS\Fixo\aliyun\SetupUE.exe" (UID: 7732) "InfoForSetup.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp\AliyunWrapExe.exe" (UID: 660) "Fixo.exe" queries basic process information of the "C:\Windows\SysWOW64\netsh.exe" (UID: 4716) "Fixo.exe" queries basic process information of the "C:\Program Files (x86)\EaseUS\EaseUS Fixo\EUinApp.exe" (UID: 4716) "Fixo.exe" queries basic process information of the "C:\Program Files (x86)\EaseUS\EaseUS Fixo\Fixo.exe" (UID: 4716)5c:Tb48,"fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FIXO1.2_TRIAL.EXE"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FIXO1.2_TRIAL"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "fixo1.2_trial.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")5d:T950,"fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\unins000.dat" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-JM20Q.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-9G5SC.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-39RGO.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-5H4AU.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-BK7J3.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-1AJM7.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-RV393.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-I7ONJ.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-IMHHC.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-TAP8K.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\is-222C0.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\config\is-D8494.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\config\is-BIRO4.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\config\is-2BUL8.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-1T0BA.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-G2T21.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-F1E1T.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-LLI8H.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-SIRDT.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-OCLTU.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-NG1OB.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-CU9FM.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-DJN4K.tmp" "fixo1.2_trial.tmp" touched file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\language\is-7E6EH.tmp"5e:T71c,"fixo1.2_trial.tmp" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "fixo1.2_trial.tmp" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Fixo\EaseUS Fixo.lnk" "fixo1.2_trial.tmp" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Fixo\Uninstall EaseUS Fixo.lnk" "fixo1.2_trial.tmp" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Fixo\Visit EaseUS.url" "fixo1.2_trial.tmp" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "fixo1.2_trial.tmp" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "fixo1.2_trial.tmp" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "AliyunWrapExe.Exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "AliyunWrapExe.Exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "AliyunWrapExe.Exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "AliyunWrapExe.Exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\index[1].htm" "AliyunWrapExe.Exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "AliyunWrapExe.Exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "AliyunWrapExe.Exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "AliyunWrapExe.Exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\index[1].htm" "PowerShell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\CatRoot" "PowerShell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\catroot2"5f:Tb61,"fixo1.2_trial.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "fixo1.2_trial.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "fixo1.2_trial.exe" trying to access non-existent file "\Device\HarddiskVolume2\FIXO1.2_TRIAL.ENU.DLL" "fixo1.2_trial.exe" trying to access non-existent file "C:\fixo1.2_trial.ENU.DLL" "fixo1.2_trial.exe" trying to access non-existent file "\Device\HarddiskVolume2\FIXO1.2_TRIAL.EN.DLL" "fixo1.2_trial.exe" trying to access non-existent file "C:\fixo1.2_trial.EN.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\FLTLIB.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\FIXO1.2_TRIAL.ENU.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\fixo1.2_trial.ENU.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\FIXO1.2_TRIAL.EN.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\fixo1.2_trial.EN.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\EaseUS\EaseUS Fixo\UNINS000.EXE" "fixo1.2_trial.tmp" trying to access non-existent file "C:\Program Files (x86)\EaseUS\EaseUS Fixo\unins000.exe" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\EaseUS\Fixo\aliyun\ALIYUNWRAP.DLL" "fixo1.2_trial.tmp" trying to access non-existent file "C:\ProgramData\EaseUS\Fixo\aliyun\AliyunWrap.dll" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\EaseUS\Fixo\aliyun\ALIYUNWRAPEXE.EXE" "fixo1.2_trial.tmp" trying to access non-existent file "C:\ProgramData\EaseUS\Fixo\aliyun\AliyunWrapExe.exe" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\EaseUS\Fixo\aliyun\INFOFORSETUP.EXE" "fixo1.2_trial.tmp" trying to access non-existent file "C:\ProgramData\EaseUS\Fixo\aliyun\InfoForSetup.exe" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\EaseUS\Fixo\aliyun\SETUPUE.EXE" "fixo1.2_trial.tmp" trying to access non-existent file "C:\ProgramData\EaseUS\Fixo\aliyun\SetupUE.exe" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\EaseUS\EaseUS Fixo\EUDOWNLOADER.EXE"60:T7c7,"fixo1.2_trial.exe" trying to access non-existent file "\Device\HarddiskVolume2\FIXO1.2_TRIAL.EXE.LOCAL" "fixo1.2_trial.exe" trying to access non-existent file "\Device\HarddiskVolume2\FIXO1.2_TRIAL.ENU" "fixo1.2_trial.exe" trying to access non-existent file "C:\fixo1.2_trial.ENU" "fixo1.2_trial.exe" trying to access non-existent file "\Device\HarddiskVolume2\FIXO1.2_TRIAL.EN" "fixo1.2_trial.exe" trying to access non-existent file "C:\fixo1.2_trial.EN" "fixo1.2_trial.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IS-VH06N.TMP" "fixo1.2_trial.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\FIXO1.2_TRIAL.TMP.LOCAL" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\FIXO1.2_TRIAL.ENU" "fixo1.2_trial.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\fixo1.2_trial.ENU" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\FIXO1.2_TRIAL.EN" "fixo1.2_trial.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\fixo1.2_trial.EN" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "fixo1.2_trial.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VH06N.tmp\fixo1.2_trial.tmp.Local\" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IS-167V6.TMP" "fixo1.2_trial.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-167V6.tmp" "fixo1.2_trial.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\EASEUS"61:T2628,Pattern match: "https://update.easeus.com/update/InnerBuyRSS_Trial_Fixo_new.zip?time=133441728071950000" Pattern match: "https://www.easeus.com/thankyou/install-fixo.html" Pattern match: "https://update.easeus.com/update/drw_eng/fixo.ini?time=133441727867800000" Heuristic match: "|Q.Lr" Heuristic match: "4{.oM" Pattern match: "http://schemas.microsof" Pattern match: "t.com/SMI/2005/WindowsSettings" Heuristic match: "w`.pf" Heuristic match: "R5.Zm" Heuristic match: ".6u.dK" Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0LE0C070*0" Pattern match: "InfoForSetup.exe/UninstallStart" Pattern match: "http://schemas.openxmlformats.org/package/2006/content-types" Pattern match: "gJI.ie/4oG+9NS_x4F6M5t#vyJqW" Pattern match: "http://ocsp.digicert.com0A5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "Q.YBE/Qb" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XL0J0H" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "o.vHC/79P" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/ThawteTimestampingCA.crl0TimeStamp-2048-10y@b%thawte" Pattern match: "cjJB.rLH/i^1nRuXL@p%" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://*excel.officeapps.live.com/*,https://*onenote.officeapps.live.com/*,https://*powerpoint.officeapps.live.com/*,https://*word-edit.officeapps.live.com/*,https://*excel.partner.officewebapps.cn/*,https://*onenote.partner.officewebapps.cn/*," Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "https://www.easeus.com/repair-tools/url_buy__abroad__trialFhttps://www.easeus.com/repair-tools/fixo-buy.html?linkid=inapp_browserurl_buy__abroad__trial__google@https://www.easeus.com/repair-tools/fixo-buy.html?linkid=ad-fixourl_chat__abroadHhttps://secure." Pattern match: "S.fl/''M-&b=]{Wu$2Y/o/~$l" Pattern match: "1123movies.la/123moviess.la/3dmmgame.com/4playstation.com/aashingtonpost.com/adultdfriendfinder.com/aircananda.com/aks.ms/alaskaaair.com/alibabaa.com/alibbaba.com/alrecipes.com/ameritraade.com/answwers.com/arketwatch.com/ashshleyfurniture.com/ationalgeogra" Pattern match: "jNs1Hx.ne/XgaC79'U4!%Egl3" Pattern match: "googleads.g.doubleclick.net/pagead/viewthroughconversion/11113079898/?random=1699727990154&cv=11&fst=1699727990154&bg=ffffff&guid=ON&async=1>m=45be3b81v9105307171&gcd=11l1l1l1l1&dma=0&u_w=1024&u_h=611&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall" Pattern match: "googleads.g.doubleclick.net/pagead/viewthroughconversion/1064956115/?random=1699727989725&cv=11&fst=1699727989725&bg=ffffff&guid=ON&async=1>m=45be3b81v875306234&gcd=11l1l1l1l1&dma=0&u_w=1024&u_h=611&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-f" Pattern match: "sslwidget.criteo.com/event?a=104435&v=5.20.0&p0=e%3Dce%26m%3D%255B%252523%252523Email%252520Address%252523%252523%255D%26h%3D%2523%2523Hash%2520Method%2523%2523&p1=e%3Dexd%26site_type%3Dd%26z%3D%2523%2523Zip%2520Code%2523%2523&p2=e%3Dvpg&p3=e%3Ddis&adce=1&" Pattern match: "IHDRsRGBDeXIfMMbIDATHlIG6.MUU/\/`4/EeY^qIEND" Pattern match: "https://update.easeus.com/update/InnerBuyRSS_Trial_Fixo_new.zip10:40:19:363" Pattern match: "https://dns.google,supports_spdy:true}],version:5},network_qualities:{CAESABiAgICA+P////8B:3G" Pattern match: "https://dns.google,supports_spdy:true}],version:5},network_qualities:{CAESABiAgICA+P////8B:4G" Pattern match: "assets.db/MANIFEST-0000012023/11/11-10:39:45.137" Pattern match: "connect.facebook.net/signals/config/239496765217947?v=2.9.138&r=stable&domain=www.easeus.com" Pattern match: "static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317" Pattern match: "www.easeus.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js" Pattern match: "www.easeus.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js" Pattern match: "widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/main.js" Pattern match: "www.googletagmanager.com/gtag/js?id=AW-11113079898&l=dataLayer&cx=c" Pattern match: "www.googletagmanager.com/gtag/js?id=AW-1064956115&l=dataLayer&cx=c" Pattern match: "www.googletagmanager.com/gtag/js?id=G-9ETQKR539E&l=dataLayer&cx=c" Pattern match: "widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js" Pattern match: "www.easeus.com/proxydirectory/tags/390467271471/tag.js" Pattern match: "www.easeus.com/default/webpack/dist/firebase.js" Pattern match: "https://www.easeus.com/repair-tools/NeedPanelViewExpend" Pattern match: "www.easeus.com/default/js/globle_js/header.js" Pattern match: "www.easeus.com/default/js/questionnaire.js" Pattern match: "www.easeus.com/default/js/ad_download.js" Pattern match: "dynamic.criteo.com/js/ld/ld.js?a=104435" Pattern match: "connect.facebook.net/en_US/fbevents.js" Pattern match: "www.easeus.com/default/js/globle.js" Pattern match: "www.easeus.com/default/js/jquery.js" Pattern match: "www.easeus.com/default/js/other.js" Pattern match: "www.googletagmanager.com/gtag/js" Pattern match: "mc.yandex.ru/metrika/tag.js" Pattern match: "bat.bing.com/bat.js" Pattern match: "https://www.easeus.com/" Heuristic match: "track.easeus.com" Heuristic match: "easeusinfo.us-east-1.log.aliyuncs.com" Heuristic match: "ag.gbc.criteo.com" Heuristic match: "analytics.google.com" Heuristic match: "connect.facebook.net" Heuristic match: "csm.da.us.criteo.net" Heuristic match: "dnacdn.net" Heuristic match: "dynamic.criteo.com" Heuristic match: "firebaseremoteconfig.googleapis.com" Heuristic match: "gem.gbc.criteo.com" Heuristic match: "googleads.g.doubleclick.net" Heuristic match: "gum.criteo.com" Heuristic match: "idsync.rlcdn.com" Heuristic match: "mc.yandex.com" Heuristic match: "mc.yandex.ru" Heuristic match: "sslwidget.criteo.com" Heuristic match: "static.cloudflareinsights.com" Heuristic match: "stats.g.doubleclick.net" Heuristic match: "update.easeus.com" Heuristic match: "widget.trustpilot.com" Pattern match: "www.bing.com" Pattern match: "www.easeus.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "https://www.easeus.com/repair-tools/" Pattern match: "https://www.easeus.com/support/fixo/index.html" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Pattern match: "http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=0" Pattern match: "https://www.easeus.com/thankyou/install-fixo.html\" Heuristic match: "PATHEXT=.CY" Heuristic match: "XE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WS" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "7180-afeu3fdgqtkpomub5chtors48o2vugrm.apps.googleusercontent.com" Heuristic match: "fixo-b5d96.appspot.com" Heuristic match: "594412807180-afeu3fdgqtkpomub5chtors48o2vugrm.apps.googleusercontent.com" Heuristic match: "tkpomub5chtors48o2vugrm.apps.googleusercontent.com" Pattern match: "https://update.easeus.com.cn/update/drw_cn/Yiwo_remote_config_data.data" Pattern match: "https://curl.haxx.se/docs/http-cookies.html" Heuristic match: "pdate.easeus.com" Pattern match: "https://update.easeus.com/updat" Heuristic match: "are.net" Heuristic match: "very-soft.com" Heuristic match: "update.easeus.com.cdn.cloudflare.net" Heuristic match: "update.cdn.c82f9fad.recovery-soft.com" Pattern match: "update.easeus.com/update/InnerBuyRSS_Trial_Fixo_new.zip?time=133441728071950000" Heuristic match: "ftp@example.com" Pattern match: "http://curl.haxx.se/docs/http-cookies.html" Pattern match: "http://www.openssl.org/support/faq.html" Pattern match: "update.easeus.com/update/drw_eng/fixo.ini?time=133441727867800000" Heuristic match: "e.cdn.c82f9fad.recovery-soft.com" Heuristic match: "e.easeus.com.cdn.cloudflare.net" Heuristic match: "pdate.easeus.com.cdn.cloudflare.net" Heuristic match: "oudflare.net" Heuristic match: "easeus.com" Pattern match: "track.easeus.com/product/index.php?c=main&a=getstatus&pid=0" Heuristic match: "rack.easeus.com" Heuristic match: "rack.easeus.com.whecloud.com" Heuristic match: "d.com" Heuristic match: "track.easeus.com.whecloud.com" Heuristic match: "aseus.com" Heuristic match: "ttps://login.live.com" Heuristic match: "loud.com" Heuristic match: "Host: track.easeus.com" Heuristic match: "tseus.com" Heuristic match: "aseusinfo.us-east-1.log.aliyuncs.com" Pattern match: "track.easeus.com/product/" Heuristic match: ".log.aliyuncs.com" Heuristic match: "eusinfo.us-east-1.log.aliyuncs.com" Heuristic match: "Host:easeusinfo.us-east-1.log.aliyuncs.com" Pattern match: "http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lb" Heuristic match: "s.com" Heuristic match: "fo.us-east-1.log.aliyuncs.com" Heuristic match: "80easeusinfo.us-east-1.log.aliyuncs.com" Heuristic match: "east-1.log.aliyuncs.com" Pattern match: "http://easeusinfo" Heuristic match: "ncs.com" Heuristic match: "iyuncs.com" Heuristic match: "s-east-1.log.aliyuncs.co" Heuristic match: "Click_Canceaseusinfo.us-east-1.log.aliyuncs.com" Heuristic match: "Cleaseusinfo.us-east-1.log.aliyuncs.com" Heuristic match: "uncs.com" Heuristic match: ";.VBS;.VBE;.JS;.JSE;.WS" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CMD;.Vi"62:Tf3f6,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001340.00000000.76400.00410000.00000004.mdmp") Found URL "https://update.easeus.com.cn/update/drw_cn/yiwo_remote_config_data.data0q" - Source: "00000000-00001340.00000000.76400.00893000.00000002.mdmp") Found URL "https://curl.haxx.se/docs/http-cookies.html" - Source: "00000000-00001340.00000000.76400.73291000.00000004.mdmp") Found URL "https://update.easeus.com/update/innerbuyrss_trial_fixo_new.zip?time=133441728071950000" - Source: "00000000-00002760.00000000.77483.02740000.00000004.mdmp") Found URL "https://update.easeus.com/updaterbuyrss_trial_fixo_new.zip?time=13:\windows\system32\fwpuclnt.dlll\programs\python\python311\;c:\use/systemroot%\system32\pnrpnsp.dllt%\system32\napinsp.dll.wsf;.wsh;.mscprocessor_architectuprocessor_architew6432=amd64proc:\windows\system32\fwpuclnt.dll:\windows\system32\iphlpapi.dll_leqprocessor_revision=4f00programdatprogramdataprogramfiles=c:\programesystemroot%\system32\pnrpnsp.dlles" - Source: "00000000-00002760.00000000.77483.02740000.00000004.mdmp") Found URL "https://update.easeus.com/update/innerbuyrss_trial_fixo_new.zip?time=133441728071950000c:\programdata\easeus\fixo/innerbuyrss.zipc:\program" - Source: "00000000-00002760.00000000.77483.02740000.00000004.mdmp") Found URL "https://update.easeus.com/update/innerbuyrss_trial_fixo_new.zip?time=133441728071950000c:\programdata\easeus\fixo/innerbuyrss.ziphmen=1w)j]/i2bt0sstcommonprogramfiles(x86)=c:\program" - Source: "00000000-00002760.00000000.77483.02740000.00000004.mdmp") Found URL "https://update.easeus.com/update/innerbuyrss_trial_fixo_new.zip?time=133441728071950000c:\programdata\easeus\fixo/innerbuyrss.zipllusersprofile=c:\programdatappdata=c:\users\hapubws\appdata\roamingommonprogramfiles=c:\program" - Source: "00000000-00002760.00000000.77483.04850000.00000004.mdmp") Found URL "https://update.easeus.com/update/innerbuyrss_trial_fixo_new.zip?time=133441728071950000ttps://update.easeus.com/update/innerbuyrss_trial_fixo_new.zip?time=133441728071950000:\programdata\easeus\fixo/innerbuyrss.zip.eudunknown" - Source: "00000000-00002760.00000000.77483.04850000.00000004.mdmp") Found URL "https://update.easeus.com/update/innerbuyrss_trial_fixo_new.zip?time=133441728071950000" - Source: "00000000-00002760.00000000.77483.04850000.00000004.mdmp") Found URL "https://update.easeus.com/update/innerbuyrss_trial_fixo_new.zip?time=133441728071950000c/imc!im)s:im)>im)" - Source: "00000000-00002760.00000000.77483.04850000.00000004.mdmp") Found URL "http://curl.haxx.se/docs/http-cookies.html" - Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found URL "ftp://%s:%s@%scontent-range:" - Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found URL "ftp://host:" - Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found URL "http://www.openssl.org/support/faq.html.....................\crypto\buffer\buf_str.crsa" - Source: "00000000-00003784.00000000.76435.002BF000.00000002.mdmp") Found URL "https://update.easeus.com/update/drw_eng/fixo.ini?time=133441727867800000c:\programdata\easeus\fixo/upgrade.inillusersprofile=c:\programdatappdata=c:\users\hapubws\appdata\roamingommonprogramfiles=c:\program" - Source: "00000000-00003784.00000000.76435.00FE0000.00000004.mdmp") Found URL "https://update.easeus.com/update/drw_eng/fixo.ini?time=133441727867800000:\programdata\easeus\fixo/upgrade.ini.eudunknown" - Source: "00000000-00003784.00000000.76435.00FE0000.00000004.mdmp") Found URL "https://update.easeus.com/update/drw_eng/fixo.ini?time=133441727867800000" - Source: "00000000-00003784.00000000.76435.00FE0000.00000004.mdmp") Found URL "https://update.easeus.com/update/drw_eng/fixo.ini?time=133441727867800000'<.u72.u)).u)-.u)" - Source: "00000000-00003784.00000000.76435.00FE0000.00000004.mdmp") Found URL "https://update.easeus.com/update/drw_eng/fixo.ini?time=133441727867800000" - Source: "00000000-00003784.00000000.76435.03310000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003784.00000000.76435.03310000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004620.00000000.75523.00F20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004620.00000001.77441.00F20000.00000004.mdmp") Found URL "http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbpost" - Source: "00000000-00004620.00000001.77441.04DD0000.00000004.mdmp") Found URL "http://easeusinfo.host:easeusinfo.us-east-1.log.aliyuncs.comcontent-md5:cfe722d35743f343765bfebc717e07a0lb" - Source: "00000000-00004620.00000001.77441.04DD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004620.00000002.79363.00F20000.00000004.mdmp") Found URL "http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbpost" - Source: "00000000-00004620.00000002.79363.04DDA000.00000004.mdmp") Found URL "http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbhttp://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbhttp://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbpost" - Source: "00000000-00004620.00000002.79363.04DDA000.00000004.mdmp") Found URL "http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbhttp://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbpost" - Source: "00000000-00004620.00000002.79363.04DDA000.00000004.mdmp") Found URL "http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbproductbad" - Source: "00000000-00004620.00000002.79363.04DDA000.00000004.mdmp") Found URL "http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbhttp://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_fixo_ip/shards/lbards/lbcontent-md5:a72de6297a6ea7c7301663ed95ca763bcontent-md5:707c8bca2b789bd45d36d011822feb7clogstores/logstore_fixo_ip/shards/lb47.252.97.21247.252.97.212192.168.243.223user-agent:" - Source: "00000000-00004620.00000002.79363.058E0000.00000004.mdmp") Found URL "https://curl.haxx.se/docs/http-cookies.html" - Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found URL "ftp://%s:%s@%scontent-range:" - Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found URL "http:///logstores//shards/lbcontent-type:application/x-protobufx-log-apiversion:0.6.0x-log-compresstype:lz4x-acs-security-token:x-log-signaturemethod:hmac-sha1date:content-md5:content-length:%dx-log-bodyrawsize:%dhost:%s.%spostapplication/x-protobufx-log-apiversion:0.6.0x-log-bodyrawsize:%dx-log-compresstype:lz4x-log-signaturemethod:hmac-sha1/logstores/%s/shards/lbpostapplication/x-protobufx-acs-security-token:%sx-log-apiversion:0.6.0x-log-bodyrawsize:%dx-log-compresstype:lz4x-log-signaturemethod:hmac-sha1/logstores/%s/shards/lbpostapplication/x-protobufx-log-apiversion:0.6.0x-log-bodyrawsize:%dx-log-signaturemethod:hmac-sha1/logstores/%s/shards/lbpostapplication/x-protobufx-acs-security-token:%sx-log-apiversion:0.6.0x-log-bodyrawsize:%dx-log-signaturemethod:hmac-sha1/logstores/%s/shards/lbauthorization:log" - Source: "00000000-00004620.00000002.79363.721E6000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004716.00000000.74541.00610000.00000004.mdmp") Found URL "https://activation.easeus.comaaa100cd68bbe03f3.awsglobalaccelerator.com216.92.61.7activation.easeus.comaaa100cd68bbe03f3.awsglobalaccelerator.com216.92.61.7http/1.0content-type:" - Source: "00000000-00004716.00000000.74541.01002000.00000002.mdmp") Found URL "https://secure.livechatinc.com/licence/1389892/v2/open_chat.cgi?groups=3url_chaturl_exit Microsoft Corporation\"\n \"InfoForSetup.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"is-NU2C4.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-5H4AU.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"is-5ORPV.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$76","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"PowerShell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5144)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .rsrc with unusual entropies 7.21075948511\n 7.0447416156","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"PowerShell.exe queries ProcessDebugPort (UID: 5144)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"$77","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"msedge.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMPRODUCTNAME\")\n \"msedge.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMMANUFACTURER\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 35294-726-00410477\n cpuid at 41030-319-00407826\n cpuid at 44507-24-10167F66\n cpuid at 46623-28-00601AF4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 35294-1-00408E7C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"Fixo.exe\" issued a query \"SELECT * FROM Win32_ComputerSystem\"\n \"Fixo.exe\" issued a query \"select ProcessorId,Name from Win32_processor\"\n \"Fixo.exe\" issued a query \"select Manufacturer from Win32_BaseBoard\"\n \"wmic.exe\" issued a query \"SELECT * FROM Win32_DiskDrive\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"Fixo.exe\" (Thread ID: 1480) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$78","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"fixo1.2_trial.tmp\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-167V6.tmp\\version.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Program Files (x86)\\desktop.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\Program Files (x86)\\EaseUS\\EaseUS Fixo\\config\\version.ini\"\n \"fixo1.2_trial.tmp\" reads file \"C:\\ProgramData\\EaseUS\\Fixo\\aliyun\\AliyunConfig.ini\"\n \"InfoForSetup.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-167V6.tmp\\AliyunConfig.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 184.25.254.41\"\n \"UDP connection to 157.240.22.25\"\n \"UDP connection to 35.190.60.146\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$79","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$7a","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 157.185.145.11 on port 80 is sent without HTTP header\n TCP traffic to 47.252.97.212 on port 80 is sent without HTTP header\n TCP traffic to 157.185.156.141 on port 80 is sent without HTTP header\n TCP traffic to 104.18.18.71 on port 443 is sent without HTTP header\n TCP traffic to 142.250.189.170 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match -: Public Private Key","description":"YARA signature for Public Private Key used in process \"00000000-00004716\"\n YARA signature for Public Private Key used in file \"is-OTOUH.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-122","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"AliyunWrapExe.Exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1066 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"wmic.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00001900-00000BC0-199779028\")\n Found string \"ROOT\\CIMV2:Win32_DiskDrive\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001900.00000000.77198.00161000.00000020.mdmp\")\n Found string \"wmic.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00001900.00000000.77198.001A9000.00000002.mdmp\")\n Found string \"C:\\WINDOWS\\SysWOW64\\Wbem\\wmic.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00001900.00000000.77198.033E0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SysWOW64\\Wbem\\wmic.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00001900.00000000.77198.033E0000.00000004.mdmp\")\n Found string \"Device\\HarddiskVolume2\\Windows\\SysWOW64\\wbem\\WMIC.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00001900.00000000.77198.033E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"fixo1.2_trial.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-VH06N.tmp\\fixo1.2_trial.tmp\" for deletion\n \"AliyunWrapExe.Exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-167V6.tmp\\tempInfo.web\" for deletion\n \"Fixo.exe\" marked \"C:\\ProgramData\\EaseUS\\Fixo\\config.ini.lock\" for deletion\n \"AliyunWrapExe.Exe\" marked \"C:\\ProgramData\\EaseUS\\Fixo\\aliyun\\tempInfo.web\" for deletion\n \"PowerShell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_x4go3zbk.2ea.ps1\" for deletion\n \"PowerShell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_r5iqgaoo.thz.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$7b","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"fixo1.2_trial.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"AliyunWrapExe.Exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"Fixo.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"PowerShell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"InfoForSetup.exe\" claimed CRC 75640 while the actual is CRC 142202\n \"is-39U8I.tmp\" claimed CRC 4029182 while the actual is CRC 75640\n \"is-5H4AU.tmp\" claimed CRC 2229684 while the actual is CRC 3702416","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$7c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"is-39U8I.tmp\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"fixo1.2_trial.tmp\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\EUinApp.exe\" Fixo.exe\" - (UID: 00000000-00007732)\n \"fixo1.2_trial.tmp\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://www.easeus.com/thankyou/install-fixo.html\" - (UID: 00000000-00007732)\n \"fixo1.2_trial.tmp\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\Fixo.exe\"\" - (UID: 00000000-00007732)\n \"Fixo.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\EuinApp.exe\" Fixo.exe\" - (UID: 00000000-00004716)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"Fixo.exe\" called \"ShellExecuteA\" with parameter %PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\EuinApp.exe (UID: 00000000-00004716)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to run the specified application","description":"\"Fixo.exe\" called \"WinExec\" with parameter netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes dir=in name=\"EaseUS Data Recovery Wizard\" program=\"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\Fixo.exe\" (UID: 00000000-00004716)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-120","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\is-OP58T.tmp\"\n File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\is-CVQMH.tmp\"\n File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\is-RFRT8.tmp\"\n File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\is-J84RD.tmp\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$7d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"malicious","category":"Network Related","name":"Detected many DNS responses with a low TTL","description":"\"analytics.google.com\" with TTL 279\n \"dnacdn.net\" with TTL 76\n \"easeusinfo.us-east-1.log.aliyuncs.com\" with TTL 60\n \"firebaseremoteconfig.googleapis.com\" with TTL 250\n \"googleads.g.doubleclick.net\" with TTL 33\n \"idsync.rlcdn.com\" with TTL 60\n \"mc.yandex.com\" with TTL 401\n \"mc.yandex.ru\" with TTL 61\n \"static.cloudflareinsights.com\" with TTL 300\n \"stats.g.doubleclick.net\" with TTL 25\n \"update.easeus.com\" with TTL 473\n \"widget.trustpilot.com\" with TTL 60\n \"www.google.com\" with TTL 198","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\n log-c-lite_0.1.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: log-c-lite_0.1.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"AliyunWrapExe.Exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\")\n \"AliyunWrapExe.Exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\"; Key: \"LOGINURL\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes dir=in name=\"EaseUS Data Recovery Wizard\" program=\"%PROGRAMFILES%\\\\(x86)\\\\EaseUS\\\\EaseUS Fixo\\\\Fixo.exe\"\" (UID: 00000000-00002640)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$7e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000648.00000000.68567.00512000.00000002.mdmp, 00000000-00000648.00000001.70489.72CE1000.00000020.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000648.00000000.68567.00512000.00000002.mdmp\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"Setup.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"AliyunWrapExe.Exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00003160-50186-384-004110C4\n Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00003160-50186-39-00405BEC\n Found reference to API RtlGetNtVersionNumbers@NTDLL.DLL at 00000000-00003880-26845-312-00401650","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"Setup.tmp\" called \"GetSystemDefaultLangID\" (UID: 00000000-00000648)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003160-50186-500-004030BC\n GetTickCount@KERNEL32.DLL at 00000000-00001644-8528-215-00C44C00\n GetTickCount@KERNEL32.DLL at 00000000-00003048-16086-215-01144C00\n GetTickCount@KERNEL32.DLL at 00000000-00003600-18620-215-003D4C00\n GetTickCount@KERNEL32.DLL at 00000000-00002380-24457-215-00E24C00\n GetTickCount@KERNEL32.DLL at 00000000-00003880-26845-413-004097AE\n GetTickCount@KERNEL32.DLL at 00000000-00002360-30541-215-00E74C00\n GetTickCount@KERNEL32.DLL at 00000000-00003148-32441-215-00054C00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00003160-50186-39-00405BEC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000648.00000000.68567.0050A000.00000004.mdmp, 00000000-00000648.00000002.72409.0050A000.00000004.mdmp, 00000000-00000648.00000003.78493.0050A000.00000004.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00000648.00000000.68567.0050A000.00000004.mdmp, 00000000-00000648.00000002.72409.0050A000.00000004.mdmp, 00000000-00000648.00000003.78493.0050A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00003880-26845-359-00401A80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00003160-50186-384-004110C4\n GetVersion@KERNEL32.DLL at 00000000-00003160-50186-89-00411000\n GetVersion@KERNEL32.DLL at 00000000-00003160-50186-90-0040646C\n GetVersionExW@KERNEL32.DLL at 00000000-00003160-50186-81-0040A358\n GetVersionExW@KERNEL32.DLL at 00000000-00003880-26845-312-00401650","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00003160-50186-38-00405DE8\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003160-50186-367-0040E640\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003160-50186-61-00408EB4\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003160-50186-54-00408F00\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00001644-8528-183-00C47E5F\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003048-16086-183-01147E5F\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003600-18620-183-003D7E5F\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002380-24457-183-00E27E5F\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003880-26845-424-0040EF3A\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003880-26845-362-00401000\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002360-30541-183-00E77E5F\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003148-32441-183-00057E5F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00003160-50186-259-00408068","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardType@USER32.DLL at 00000000-00003160-50186-95-004036DC\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00003160-50186-368-0040E66C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000600h\" and \"je 0041112Bh\" at 00000000-00003160-50186-384-004110C4\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp edx, 05h\" and \"jne 0040648Bh\" at 00000000-00003160-50186-90-0040646C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$80","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00000648.00000000.68567.00512000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyEx\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$81","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000648.00000000.68567.01FF0000.00000004.mdmp, 00000000-00000648.00000001.70489.01FF0000.00000004.mdmp, 00000000-00000648.00000002.72409.01FF0000.00000004.mdmp\")\n Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx returned hProcess=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000648.00000000.68567.0050A000.00000004.mdmp, 00000000-00000648.00000002.72409.0050A000.00000004.mdmp, 00000000-00000648.00000003.78493.0050A000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000648.00000000.68567.0050A000.00000004.mdmp, 00000000-00000648.00000001.70489.72CE1000.00000020.mdmp, 00000000-00000648.00000002.72409.0050A000.00000004.mdmp, 00000000-00000648.00000003.78493.0050A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"sync_cookie_csrf2800255692fakemc.yandex.com/2147484672200959948831063772424511991031063771\" (Indicator: \"yandex.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Setup.exe\" connecting to \"\\ThemeApiPort\"\n \"Setup.tmp\" connecting to \"\\ThemeApiPort\"\n \"AliyunWrapExe.Exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00000648.00000000.68567.00512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"AliyunWrapExe.Exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /product/index.php?c=main&a=getstatus&pid=0\" - (UID: 00000000-00003172), \"AliyunWrapExe.Exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /product/index.php?c=main&a=getstatus&pid=0\" - (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"AliyunWrapExe.Exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003172)\n \"AliyunWrapExe.Exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"AliyunWrapExe.Exe\" called \"InternetReadFile\" with parameter 1 (UID: 00000000-00003172)\n \"AliyunWrapExe.Exe\" called \"InternetReadFile\" with parameter 1 (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"AliyunWrapExe.Exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (UID: 00000000-00003172)\n \"AliyunWrapExe.Exe\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0\" (UID: 00000000-00003172)\n \"AliyunWrapExe.Exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (UID: 00000000-00002692)\n \"AliyunWrapExe.Exe\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0\" (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"v8b253dfea2ab4077af8c6f58422dfbfd1689876627854_1_.js\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00000648.00000000.68567.01FF0000.00000004.mdmp, 00000000-00000648.00000001.70489.01FF0000.00000004.mdmp, 00000000-00000648.00000002.72409.01FF0000.00000004.mdmp\")\n Found reference to API \"{cm:CreateDesktopIcon}\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00000648.00000000.68567.01FF0000.00000004.mdmp, 00000000-00000648.00000001.70489.01FF0000.00000004.mdmp, 00000000-00000648.00000002.72409.01FF0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00003160-50186-356-0040E158\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00003160-50186-357-0040E11C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp, 00000000-00000648.00000001.70489.72CE1000.00000020.mdmp\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000648.00000001.70489.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"Format ID\" (Indicator: \"format \"; File: \"is-T617D.tmp.483595874\")\n Found string \"format error in certificate's notBefore field\" (Indicator: \"format \"; File: \"is-3ADM3.tmp.646642346\")\n Found string \"format error in certificate's notAfter field\" (Indicator: \"format \"; File: \"is-3ADM3.tmp.646642346\")\n Found string \"format error in CRL's lastUpdate field\" (Indicator: \"format \"; File: \"is-3ADM3.tmp.646642346\")\n Found string \"format error in CRL's nextUpdate field\" (Indicator: \"format \"; File: \"is-3ADM3.tmp.646642346\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00000648.00000000.68567.0050A000.00000004.mdmp, 00000000-00000648.00000001.70489.72CE1000.00000020.mdmp, 00000000-00000648.00000002.72409.0050A000.00000004.mdmp, 00000000-00000648.00000003.78493.0050A000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00000648.00000000.68567.0050A000.00000004.mdmp, 00000000-00000648.00000001.70489.72CE1000.00000020.mdmp, 00000000-00000648.00000002.72409.0050A000.00000004.mdmp, 00000000-00000648.00000003.78493.0050A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000648.00000000.68567.0050A000.00000004.mdmp, 00000000-00000648.00000001.70489.72CE1000.00000020.mdmp, 00000000-00000648.00000002.72409.0050A000.00000004.mdmp, 00000000-00000648.00000003.78493.0050A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Setup.tmp\" opened \"\\Device\\KsecDD\"\n \"InfoForSetup.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"email-decode.min_1_.js\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"$83","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"{683B331D-6ACC-11EE-8FC6-08002749AE49}\" (Indicator: \"080027\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00003160-50186-396-0040EE14","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"InfoForSetup.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"Setup.tmp\" allocated memory in \"%TEMP%\\is-52VJ2.tmp\\Setup.tmp\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00003160-50186-696-004068A2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Modifies firewall settings"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Fingerprint","details_count":7,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected many DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 24 domains and 24 hosts"}],"sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}]},"activity":{"stats":{"process_count":65,"spawned_processes_count":65,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":70,"imported_dlls_count":282,"dropped_files_count":0,"extracted_files_count":47,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":31,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":34,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":25,"dns_resolutions_count":24,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["chir","floxif","neshta","yandex","yandexbundled","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"654fc93a9aa903d69d0a53bb","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"fixo1.2_trial.exe","analysis_start_time":"2023-11-11T18:34:37+00:00","indicators_count":{"informative":242,"suspicious":91,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"652af12b8cd2f1d1210d72cc","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Setup.exe","analysis_start_time":"2023-10-14T20:08:12+00:00","indicators_count":{"informative":221,"suspicious":76,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"157.185.145.11","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"address":"47.252.97.212","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"address":"104.18.19.71","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"address":"184.25.254.41","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"157.185.156.141","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"104.16.56.101","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"87.250.250.119","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"108.139.10.31","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"157.240.22.25","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"74.119.118.155","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"142.251.46.194","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"216.239.32.181","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"142.251.2.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"104.18.18.71","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"address":"35.190.60.146","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"157.240.22.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"142.250.189.170","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"74.119.118.149","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"142.250.189.164","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"74.119.118.138","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"199.204.170.104","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"199.204.170.226","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"74.119.118.154","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"address":"157.185.148.142","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"address":"104.16.57.101","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}],"dns_resolutions":[{"domain":"ag.gbc.criteo.com","address":"199.204.170.104","ttl":13281,"country":"United States","registrar_name":"Ascio Technologies, Inc","registrar_organization":"Criteo SA","registrar_name_servers":"NS1.CRITEO.COM","registrar_creation_date":"2005-06-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"analytics.google.com","address":"216.239.32.181","ttl":279,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"connect.facebook.net","address":"157.240.22.25","ttl":1913,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Facebook, Inc.","registrar_name_servers":"A.NS.FACEBOOK.COM","registrar_creation_date":"2004-04-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"csm.da.us.criteo.net","address":"74.119.118.154","ttl":823,"country":"United States","registrar_name":"Ascio Technologies, Inc","registrar_organization":"Criteo SA","registrar_name_servers":"NS1.CRITEO.COM","registrar_creation_date":"2005-06-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"dnacdn.net","address":"74.119.118.149","ttl":76,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"CRITEO SA","registrar_name_servers":"NS22.CRITEO.COM","registrar_creation_date":"2019-07-17T18:43:38+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"dynamic.criteo.com","address":"74.119.118.155","ttl":2094,"country":"United States","registrar_name":"Ascio Technologies, Inc","registrar_organization":"Criteo SA","registrar_name_servers":"NS1.CRITEO.COM","registrar_creation_date":"2005-06-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"easeusinfo.us-east-1.log.aliyuncs.com","address":"47.252.97.212","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Zhejiang Alibaba Cloud Computing Ltd. (浙江阿里巴巴云计算有限公司)","registrar_name_servers":"NS3.ALIYUN.COM","registrar_creation_date":"2012-04-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"domain":"firebaseremoteconfig.googleapis.com","address":"142.250.189.170","ttl":250,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"gem.gbc.criteo.com","address":"199.204.170.226","ttl":19660,"country":"United States","registrar_name":"Ascio Technologies, Inc","registrar_organization":"Criteo SA","registrar_name_servers":"NS1.CRITEO.COM","registrar_creation_date":"2005-06-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"googleads.g.doubleclick.net","address":"142.251.46.194","ttl":33,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"gum.criteo.com","address":"74.119.118.149","ttl":1499,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"idsync.rlcdn.com","address":"35.190.60.146","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"mc.yandex.com","address":"87.250.250.119","ttl":401,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"mc.yandex.ru","address":"87.250.250.119","ttl":61,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"sslwidget.criteo.com","address":"74.119.118.138","ttl":2077,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"static.cloudflareinsights.com","address":"104.16.56.101","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"domain":"stats.g.doubleclick.net","address":"142.251.2.157","ttl":25,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"track.easeus.com","address":"157.185.156.141","ttl":600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"domain":"update.easeus.com","address":"104.18.18.71","ttl":473,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"domain":"widget.trustpilot.com","address":"108.139.10.31","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"www.bing.com","address":"184.25.254.41","ttl":10880,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"www.easeus.com","address":"104.18.18.71","ttl":600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"domain":"www.facebook.com","address":"157.240.22.35","ttl":1236,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"domain":"www.google.com","address":"142.250.189.164","ttl":198,"country":"United States","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]}],"http_requests":[{"host":"track.easeus.com","host_ip":"157.185.145.11:80","url":"/product/index.php?c=main&a=getstatus&pid=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /product/index.php?c=main&a=getstatus&pid=0 HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: track.easeus.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"host":"easeusinfo.us-east-1.log.aliyuncs.com","host_ip":"47.252.97.212:80","url":"/logstores/logstore_fixo_ip/shards/lb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /logstores/logstore_fixo_ip/shards/lb HTTP/1.1\nHost:easeusinfo.us-east-1.log.aliyuncs.com\nUser-Agent: log-c-lite_0.1.0\nAccept: */*\nContent-Type:application/x-protobuf\nx-log-apiversion:0.6.0\nx-log-compresstype:lz4\nx-log-signaturemethod:hmac-sha1\nDate:Sat, 11 Nov 2023 18:37:41 GMT\nContent-MD5:B77F225AE32610D28A01A58DBB83AAE3\nContent-Length:182\nx-log-bodyrawsize:180\nAuthorization:LOG LTAIBDHwLKKvsH19:rsoBM5QXTCXJuZYwnJvsBBud1CE=","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}],"processes":[{"pid":6792,"ppid":0,"name":"fixo1.2_trial.exe","command_line":"","sha256":"b8a1a43638c3aa60535b174037eccb242711e0ff03689cacfb9a413da5e38375","normalized_path":"C:\\fixo1.2_trial.exe","uid":"00000000-00006792","icon":"$84"},{"pid":7732,"ppid":6792,"name":"fixo1.2_trial.tmp","command_line":"/SL5=\"$903A6,47985566,199168,C:\\fixo1.2_trial.exe\"","sha256":"f4524e9084afc494d45ff8396faeae737315224add7d1eb17174ebe06d04816c","normalized_path":"%TEMP%\\is-VH06N.tmp\\fixo1.2_trial.tmp","parent_uid":"00000000-00006792","uid":"00000000-00007732"},{"pid":660,"ppid":7732,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Langsel\" \"Activity\" \"Click_Confirm\" \"Attribute\" \"{\\\"Language\\\":\\\"en\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%TEMP%\\is-167V6.tmp\\InfoForSetup.exe","parent_uid":"00000000-00007732","uid":"00000000-00000660"},{"pid":6744,"ppid":660,"name":"AliyunWrapExe.Exe","command_line":"","sha256":"865e5a7103036b8660eed9e89ed1d261a4eb49e205858c5827076646d196c90e","normalized_path":"%TEMP%\\is-167V6.tmp\\AliyunWrapExe.Exe","parent_uid":"00000000-00000660","uid":"00000000-00006744"},{"pid":6788,"ppid":7732,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Setup\" \"Activity\" \"Click_Next\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%TEMP%\\is-167V6.tmp\\InfoForSetup.exe","parent_uid":"00000000-00007732","uid":"00000000-00006788"},{"pid":6296,"ppid":7732,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Licenseagreement\" \"Activity\" \"Click_Accept\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%TEMP%\\is-167V6.tmp\\InfoForSetup.exe","parent_uid":"00000000-00007732","uid":"00000000-00006296"},{"pid":2180,"ppid":7732,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Selectdestinationlocation\" \"Activity\" \"Click_Confirm\" \"Attribute\" \"{\\\"Path\\\":\\\"%PROGRAMFILES%\\(x86)/EaseUS/EaseUS Fixo\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%TEMP%\\is-167V6.tmp\\InfoForSetup.exe","parent_uid":"00000000-00007732","uid":"00000000-00002180"},{"pid":7956,"ppid":7732,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Selectadditionaltasks\" \"Activity\" \"Click_Install\" \"Attribute\" \"{\\\"Test_id\\\":\\\"TR120_1012\\\",\\\"Version\\\":\\\"Trial_trial\\\",\\\"Num\\\":\\\"1.2.0.0\\\",\\\"Language\\\":\\\"en\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%TEMP%\\is-167V6.tmp\\InfoForSetup.exe","parent_uid":"00000000-00007732","uid":"00000000-00007956"},{"pid":1036,"ppid":7732,"name":"EUinApp.exe","command_line":"Fixo.exe","sha256":"0e3ee9ae56c10d039904ea7cbf6dddb0c18dfc92ced94740d6ac25b748b1a6e1","normalized_path":"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\EUinApp.exe","parent_uid":"00000000-00007732","uid":"00000000-00001036"},{"pid":2144,"ppid":7732,"name":"msedge.exe","command_line":"--single-argument https://www.easeus.com/thankyou/install-fixo.html","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007732","uid":"00000000-00002144"},{"pid":4132,"ppid":2144,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0x158,0x7ffd183cb208,0x7ffd183cb218,0x7ffd183cb228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00004132"},{"pid":7120,"ppid":2144,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1404 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00007120"},{"pid":6252,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00006252"},{"pid":5936,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00005936"},{"pid":7188,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1185915778 --mojo-platform-channel-handle=3268 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00007188"},{"pid":5940,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1186368306 --mojo-platform-channel-handle=3292 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00005940"},{"pid":6956,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3468 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00006956"},{"pid":8032,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1187207034 --mojo-platform-channel-handle=3600 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00008032"},{"pid":6692,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1187606427 --mojo-platform-channel-handle=3836 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00006692"},{"pid":2208,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1188003047 --mojo-platform-channel-handle=3604 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00002208"},{"pid":2712,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1188417993 --mojo-platform-channel-handle=3856 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00002712"},{"pid":2736,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1188766625 --mojo-platform-channel-handle=3608 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00002736"},{"pid":3536,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5344 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00003536"},{"pid":3924,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5440 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00003924"},{"pid":4964,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6436 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00004964"},{"pid":6192,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6788 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00006192"},{"pid":6800,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6964 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00006800"},{"pid":7868,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7292 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00007868"},{"pid":8180,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=8068 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00008180"},{"pid":1604,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1219633898 --mojo-platform-channel-handle=4200 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00001604"},{"pid":1676,"ppid":2144,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --time-ticks-at-unix-epoch=-1699726778555737 --launch-time-ticks=1220025143 --mojo-platform-channel-handle=7056 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00001676"},{"pid":6708,"ppid":2144,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1948 --field-trial-handle=1980,i,18076890152414229240,16521500614176968698,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002144","uid":"00000000-00006708"},{"pid":4716,"ppid":7732,"name":"Fixo.exe","command_line":"","sha256":"4c5e96bb15a8358aa1e8b9ed5760cdf5b8831949f1259397b83f0624972ebf34","normalized_path":"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\Fixo.exe","parent_uid":"00000000-00007732","uid":"00000000-00004716"},{"pid":2640,"ppid":4716,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes dir=in name=\"EaseUS Data Recovery Wizard\" program=\"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\Fixo.exe\"","sha256":"6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb","normalized_path":"%WINDIR%\\SysWOW64\\netsh.exe","parent_uid":"00000000-00004716","uid":"00000000-00002640"},{"pid":4572,"ppid":4716,"name":"EuinApp.exe","command_line":"Fixo.exe","sha256":"0e3ee9ae56c10d039904ea7cbf6dddb0c18dfc92ced94740d6ac25b748b1a6e1","normalized_path":"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\EuinApp.exe","parent_uid":"00000000-00004716","uid":"00000000-00004572"},{"pid":3568,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Trigger_Firebase\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00003568"},{"pid":1340,"ppid":4716,"name":"firebasefetch.exe","command_line":"0 㩃停潲牧浡慄慴䕜獡啥屓楆潸","sha256":"be83e65870ed98fc5b2fe2b91e947b15029659605d44d5395d0710c506cfcb54","normalized_path":"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\firebasefetch.exe","parent_uid":"00000000-00004716","uid":"00000000-00001340"},{"pid":8104,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Checkingupdate\" Activity \"Trigger_Checkingupdate\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00008104"},{"pid":3784,"ppid":4716,"name":"EuDownloader.exe","command_line":"\"https://update.easeus.com/update/drw_eng/fixo.ini?time=133441727867800000\" \"%ALLUSERSPROFILE%\\EaseUS\\Fixo/Upgrade.ini\"","sha256":"d13408af49ead35466dddde2c2292158119c80570bb045efc548f05d79adebc8","normalized_path":"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\EuDownloader.exe","parent_uid":"00000000-00004716","uid":"00000000-00003784"},{"pid":6452,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Checkingupdate\" Activity \"Result_Checkupdate\" Attribute \"{\\\"Elapsed\\\":\\\"8\\\",\\\"Error\\\":\\\"-1\\\",\\\"Result\\\":\\\"Fail\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00006452"},{"pid":4120,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Checkfailed\" Activity \"Click_Cancel\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00004120"},{"pid":1900,"ppid":4716,"name":"wmic.exe","command_line":"wmic DISKDRIVE","sha256":"eff503b992a6e6ecae93b2b3bc6fa6b0cda0b5ee4ad99c8eb160b586271a57f8","normalized_path":"%WINDIR%\\SysWOW64\\Wbem\\wmic.exe","parent_uid":"00000000-00004716","uid":"00000000-00001900"},{"pid":1312,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Promotion\" Source \"Exit\" Activity \"Trigger_Download\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00001312"},{"pid":1320,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Info_App\" Attribute \"{\\\"Language\\\":\\\"English\\\",\\\"Num\\\":\\\"1.2.0.0\\\",\\\"Packdate\\\":\\\"2023-10-12\\\",\\\"Testid\\\":\\\"TR120_1012\\\",\\\"Version\\\":\\\"Trial\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00001320"},{"pid":6276,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Info_Start\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00006276"},{"pid":7628,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Trigger_Enumpartition\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00007628"},{"pid":7260,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Info_Installedapps\" Attribute \"{\\\"Installedapps\\\":{\\\"competitors\\\":[\\\"\\\"],\\\"easeus\\\":[\\\"\\\"]}}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00007260"},{"pid":816,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Result_Firebase\" Attribute \"{\\\"Elapsed\\\":\\\"18\\\",\\\"Error\\\":\\\"Timeout\\\",\\\"Result\\\":\\\"Fail\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00000816"},{"pid":2760,"ppid":4716,"name":"EuDownloader.exe","command_line":"\"https://update.easeus.com/update/InnerBuyRSS_Trial_Fixo_new.zip?time=133441728071950000\" \"%ALLUSERSPROFILE%\\EaseUS\\Fixo/InnerBuyRSS.zip\"","sha256":"d13408af49ead35466dddde2c2292158119c80570bb045efc548f05d79adebc8","normalized_path":"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\EuDownloader.exe","parent_uid":"00000000-00004716","uid":"00000000-00002760"},{"pid":7652,"ppid":4716,"name":"InfoForSetup.exe","command_line":"$85","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00007652"},{"pid":5144,"ppid":4716,"name":"PowerShell.exe","command_line":"PowerShell \"Get-PhysicalDisk | Format-Table -AutoSize\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShell.exe","parent_uid":"00000000-00004716","uid":"00000000-00005144"},{"pid":2872,"ppid":5144,"name":"WerFault.exe","command_line":"-u -p 5144 -s 2536","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005144","uid":"00000000-00002872"},{"pid":3000,"ppid":5144,"name":"WerFault.exe","command_line":"-u -p 5144 -s 2536","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005144","uid":"00000000-00003000"},{"pid":4156,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Promotion\" Source \"Exit\" Activity \"Result_Download\" Attribute \"{\\\"Elapsed\\\":\\\"18\\\",\\\"Error\\\":\\\"0\\\",\\\"Result\\\":\\\"Success\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00004156"},{"pid":7800,"ppid":4716,"name":"EUUnZip.exe","command_line":"\"%ALLUSERSPROFILE%\\EaseUS\\Fixo/InnerBuyRSS.zip\" \"%ALLUSERSPROFILE%\\EaseUS\\Fixo/InnerBuyRSS\"","sha256":"8201e94b203a2e8fb27035e3cd4c8cb22c497ca49a43264099119b57a084b868","normalized_path":"%PROGRAMFILES%\\(x86)\\EaseUS\\EaseUS Fixo\\EUUnZip.exe","parent_uid":"00000000-00004716","uid":"00000000-00007800"},{"pid":3068,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Result_Inappsource\" Attribute \"{\\\"Elapsed\\\":\\\"17\\\",\\\"Error\\\":\\\"0\\\",\\\"Result\\\":\\\"Success\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00003068"},{"pid":2812,"ppid":4716,"name":"InfoForSetup.exe","command_line":"$86","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00002812"},{"pid":7032,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Info_Hardware\" Attribute \"{\\\"Cpu\\\":\\\"\\\",\\\"Display\\\":\\\"(Standard monitor types) Generic Non-PnP Monitor\\\",\\\"Memory\\\":\\\"4096MB\\\",\\\"Model\\\":\\\"ASUSTeK Computer Inc. X00Z\\\",\\\"Os\\\":\\\"Microsoft Windows 10 x64\\\",\\\"Oslanguage\\\":\\\"0x409 English (United States)\\\",\\\"Processornum\\\":\\\"4\\\",\\\"Resolution\\\":\\\"1280 * 1024\\\",\\\"SysBit\\\":\\\"64\\\",\\\"Type\\\":\\\"PC\\\",\\\"Windows\\\":\\\"10.0.16299\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00007032"},{"pid":7504,"ppid":4716,"name":"InfoForSetup.exe","command_line":"/SendInfo Window \"Load\" Activity \"Info_User\" Attribute \"{\\\"Country\\\":\\\"United States\\\",\\\"Timezone\\\":\\\"GMT-08:00\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00004716","uid":"00000000-00007504"},{"pid":6104,"ppid":7732,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Install\" \"Activity\" \"Click_Finish\" \"Attribute\" \"{\\\"Launch\\\":\\\"Check\\\",\\\"Participate\\\":\\\"Check\\\",\\\"Url\\\":\\\"https://www.easeus.com/thankyou/install-fixo.html\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%TEMP%\\is-167V6.tmp\\InfoForSetup.exe","parent_uid":"00000000-00007732","uid":"00000000-00006104"},{"pid":7432,"ppid":7732,"name":"SetupUE.exe","command_line":"/Enable \"{\\\"Language\\\":\\\"en\\\",\\\"Version\\\":\\\"Trial\\\",\\\"Version_Num\\\":\\\"1.2.0.0\\\",\\\"page_id\\\":\\\"\\\",\\\"UE\\\":\\\"On\\\"}\"","sha256":"6efa1ad60cdee231d8fb11b4b7efca5b84d4243eb28e04f0acd85168de908c7e","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\SetupUE.exe","parent_uid":"00000000-00007732","uid":"00000000-00007432"},{"pid":6384,"ppid":7432,"name":"InfoForSetup.exe","command_line":"/Enable","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00007432","uid":"00000000-00006384"},{"pid":5868,"ppid":7432,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Install\" \"Activity\" \"Info_Userinfo\" \"Attribute\" \"{\\\"Language\\\":\\\"en\\\",\\\"Version\\\":\\\"Trial\\\",\\\"Version_Num\\\":\\\"1.2.0.0\\\",\\\"page_id\\\":\\\"\\\",\\\"UE\\\":\\\"On\\\",\\\"Country\\\":\\\"United States\\\",\\\"Timezone\\\":\\\"GMT-08:00\\\",\\\"OS\\\":\\\"Microsoft Windows 10 64-bit (10.0.16299.1.256)\\\",\\\"Test_id\\\":\\\"TR120_1012\\\"}\"","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\InfoForSetup.exe","parent_uid":"00000000-00007432","uid":"00000000-00005868"},{"pid":4620,"ppid":5868,"name":"AliyunWrapExe.Exe","command_line":"","sha256":"865e5a7103036b8660eed9e89ed1d261a4eb49e205858c5827076646d196c90e","normalized_path":"%ALLUSERSPROFILE%\\EaseUS\\Fixo\\aliyun\\AliyunWrapExe.Exe","parent_uid":"00000000-00005868","uid":"00000000-00004620"},{"pid":2856,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 5144 -ip 5144","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002856","icon":"$87"}],"all_imported_dlls":["sfc_os.dll","nlaapi.dll","Qt5Widgets.dll","GdiPlus.dll","nshwfp.dll","System.Management.Automation.dll","MpClient.dll","msctf.dll","cryptsp.dll","msvcp110_win.dll","msasn1.dll","d3d11.dll","wmiutils.dll","cryptbase.dll","ntasn1.dll","rmclient.dll","ucrtbase_clr0400.dll","kernel.appcore.dll","OneCoreUAPCommonProxyStub.dll","winhttp.dll","Windows.Networking.Connectivity.dll","BitsProxy.dll","fltLib.dll","shell32.dll","dhcpcsvc6.dll","mscorlib.ni.dll","schannel.dll","BCP47Langs.dll","gpapi.dll","wldp.dll","winipsec.dll","msvcp_win.dll","rasmontr.dll","msvcr90.dll","oneds.dll","Microsoft.Management.Infrastructure.Native.dll","KernelBase.dll","clbcatq.dll","KBDUS.DLL","Qt5WinExtras.dll","dot3cfg.dll","xmllite.dll","globinputhost.dll","ExplorerFrame.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","rasman.dll","dnsapi.dll","mdmregistration.dll","crypt32.dll","dhcpcsvc.dll","userenv.dll","wtsapi32.dll","OneCoreCommonProxyStub.dll","advapi32.dll","comctl32.dll","ncrypt.dll","wininet.dll","msisip.dll","msedge.dll","wlancfg.dll","clr.dll","Microsoft.PowerShell.ConsoleHost.dll","bcryptprimitives.dll","ffmpeg.dll","cldapi.dll","propsys.dll","ntdll.dll","user32.dll","bcrypt.dll","devobj.dll","vk_swiftshader.dll","wshext.dll","libeay32.dll","wbemsvc.dll","Microsoft.Management.Infrastructure.ni.dll","System.Transactions.dll","version.dll","vaultcli.dll","OpcServices.dll","Windows.Globalization.dll","mscms.dll","Windows.StateRepositoryPS.dll","linkinfo.dll","dsreg.dll","wintrust.dll","DWrite.dll","cscapi.dll","npmproxy.dll","Qt5Core.dll","imm32.dll","mf.dll","mscoree.dll","rasadhlp.dll","Windows.Security.Authentication.Web.Core.dll","onex.dll","pwrshsip.dll","Microsoft.AppV.AppvClientComConsumer.dll","eappcfg.dll","rpcrt4.dll","nshhttp.dll","adsldpc.dll","framedynos.dll","win32u.dll","netprofm.dll","cabinet.dll","powrprof.dll","setupapi.dll","imagehlp.dll","msIso.dll","netapi32.dll","winmm.dll","samcli.dll","FWPUCLNT.DLL","sspicli.dll","iertutil.dll","msedge_elf.dll","twinapi.dll","dxgi.dll","amsi.dll","rsaenh.dll","kernel32.dll","CoreMessaging.dll","UIAutomationCore.dll","msvcp140.dll","qjpeg.dll","P2P.dll","combase.dll","TextInputFramework.dll","aepic.dll","Wldap32.dll","winmmbase.dll","msvcr120.dll","dwmapi.dll","IPHLPAPI.DLL","dbghelp.dll","Windows.Security.Authentication.OnlineId.dll","wbemprox.dll","WinTypes.dll","msvcp90.dll","PCPKsp.dll","mpr.dll","winnsi.dll","sxs.dll","vcruntime140_clr0400.dll","ucrtbase.dll","dpapi.dll","ktmw32.dll","windows.storage.dll","msimg32.dll","AliyunWrap.dll","clrjit.dll","mswsock.dll","normaliz.dll","apphelp.dll","urlmon.dll","psapi.dll","fastprox.dll","vbscript.dll","microsoft_apis.dll","MpOAV.dll","telclient.dll","mfc42u.dll","wow64win.dll","shfolder.dll","RstrtMgr.dll","sfc.dll","fwpolicyiomgr.dll","wow64cpu.dll","gdi32full.dll","cfgmgr32.dll","profapi.dll","CoreUIComponents.dll","OnDemandConnRouteHelper.dll","polstore.dll","System.Core.ni.dll","tiptsf.dll","Windows.Shell.ServiceHostBuilder.dll","cryptnet.dll","mlang.dll","DataExchange.dll","eappprxy.dll","MSOXMLMF.DLL","wkscli.dll","whhelper.dll","Qt5Gui.dll","sppc.dll","Windows.UI.dll","mfplat.dll","oleaut32.dll","ole32.dll","ieframe.dll","ntmarta.dll","winsta.dll","qwindows.dll","firebaseonlineconfig.dll","coml2.dll","AppxSip.dll","dcomp.dll","tbs.dll","ncryptsslp.dll","slc.dll","gdi32.dll","uxtheme.dll","edputil.dll","wbemcomn.dll","Microsoft.AppV.AppVClientPowerShell.dll","VxSSL32.dll","vulkan-1.dll","vcruntime140.dll","msvcrt.dll","shlwapi.dll","msftedit.dll","ntshrui.dll","twinapi.appcore.dll","wevtapi.dll","SHCore.dll","secur32.dll","mskeyprotect.dll","ws2_32.dll","atl.dll","diasymreader.dll","sechost.dll","comdlg32.dll","srvcli.dll","netutils.dll","nsi.dll","dmcmnutils.dll","wow64.dll","WSHTCPIP.DLL","wshqos.dll","webio.dll","wuaueng.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","SensApi.dll","sqmapi.dll","d2d1.dll","devrtl.dll","ssv.dll","imgutil.dll","oleaccrc.dll","IEShims.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","tzres.dll","netmsg.dll","oleacc.dll","t2embed.dll","WindowsCodecs.dll","mshtml.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wship6.dll","AcGenral.dll","ieui.dll","rpcss.dll","mscoreei.dll","MSOHEV.DLL","d3d10warp.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","dui70.dll","QAGENTRT.DLL","jscript9.dll","usp10.dll","msacm32.dll","RpcRtRemote.dll","VxSSL64.dll","credssp.dll","fveui.dll","jp2ssv.dll","imageres.dll","mscorwks.dll","URLREDIR.DLL","lpk.dll","msvcr100.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ieproxy.dll","api-ms-win-downlevel-version-l1-1-0.dll","deploy.dll","api-ms-win-core-synch-l1-2-0.dll","duser.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","msimtf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AliyunWrapExe.exe","sha256":"865e5a7103036b8660eed9e89ed1d261a4eb49e205858c5827076646d196c90e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"InfoForSetup.exe","sha256":"1b1545f15af4bc38224b0668cfa797d15340fe067cf0feebc0eede65beda4eca","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"AliyunWrap.dll","sha256":"cb4d9e9e8995f6544dc2ebb28db9930e28597b0403637f15ca656231d7bd0609","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"EuCfg.bin","sha256":"4cda341ae6edf006eb7b34737f80b9bea297d5f6fa8acd5ec398f2385b6f5ad6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Fixo.log","sha256":"bda4fe6f21e43d9fb928d76a7fce5378e8edad76c5da0a339de9494d310df1c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"InnerBuyRSS.zip.eud","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-3PUD8.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-7D0NE.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-7LNQF.tmp","sha256":"0cb327b7ea0d4a3aa5d5cdad53147359feb1b8cbd97b1603eedef37bbe036bdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-64OKH.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-RSENC.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-764E0.tmp","sha256":"5f4351494173fdd2bff6414b3eacf0ff04e8d3d7fa0cdc43d6beafb7fb61b6fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-31IAG.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-JHAKC.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-TMR7I.tmp","sha256":"4cfaba288034a082c566061bd93849ba5b9fd7a2cc7131bf583b55b72f01b65c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-5GKEU.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-FNSB4.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-G02DI.tmp","sha256":"40c3c1973f44654c3854a3284a3ce82374486f3e9a2bee339b45c244002d0b8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-AE5D5.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-E8O9I.tmp","sha256":"aeb15eef2df3bc6459ed598ae05447dd69eb814fc431af3ef35f9b42bb997c42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-M4C1L.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-P135J.tmp","sha256":"94dd4847f50481c3bebef90358fdbb6338c7a24cf95370e49b595a166c4827d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"is-R25E1.tmp","sha256":"87489e264a7fd83c89c56939e34b318e7c5ba26b3786786ceb1224f80f35ace5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"EaseUS Fixo.lnk","sha256":"c1e4f418af87174a1d771aa66eaec6f1f8ff129edad54e5b11dbd894a2fb0f7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Uninstall EaseUS Fixo.lnk","sha256":"2202b46d80a8862153d35bf13240e2665aa2e0e6589b0cc8db4849bf21369faf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"58480f8ff3eb74bdac.bin","sha256":"4ce57f8569310384f7a559f3ba6b97f25dbd196fc540af438217b0de693a7635","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-8HKFJ.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-O04PS.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-D0BM6.tmp","sha256":"0cb327b7ea0d4a3aa5d5cdad53147359feb1b8cbd97b1603eedef37bbe036bdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-C7SJS.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-TLFFS.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-DEDS4.tmp","sha256":"5f4351494173fdd2bff6414b3eacf0ff04e8d3d7fa0cdc43d6beafb7fb61b6fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-5MTPI.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-RF5RE.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-5KK5K.tmp","sha256":"4cfaba288034a082c566061bd93849ba5b9fd7a2cc7131bf583b55b72f01b65c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-0ITO7.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-56HJ9.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-CE3M2.tmp","sha256":"40c3c1973f44654c3854a3284a3ce82374486f3e9a2bee339b45c244002d0b8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-C27T6.tmp","sha256":"aeb15eef2df3bc6459ed598ae05447dd69eb814fc431af3ef35f9b42bb997c42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-CPBBJ.tmp","sha256":"94dd4847f50481c3bebef90358fdbb6338c7a24cf95370e49b595a166c4827d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-D40IJ.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-O6E2S.tmp","sha256":"87489e264a7fd83c89c56939e34b318e7c5ba26b3786786ceb1224f80f35ace5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-Q1TKC.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-1AKBT.tmp","sha256":"829d60f6dcc5f686e8056d46420552801b0e2c5050da1858530c1284caca4fcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-64P8H.tmp","sha256":"5809a5cbb714088c3d455292ee037a67de348c74faf85dcd2b0b4d4b28e44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"is-ELG42.tmp","sha256":"e61436b47cda0c0edcb4cc652e88a2493f64376dec7e4b554f433b68d30bc92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"path":"%TEMP%\\is-167V6.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{26305011-C9C0-400C-9BF3-1F3819DC488B}","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_BROWSER_EMULATION\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SHELL EXTENSIONS\\CACHED\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{7FBAC2CF-E843-4C61-B0C5-F7FA3A3BC375}\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{7FBAC2CF-E843-4C61-B0C5-F7FA3A3BC375}\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DOWNLOADMANAGER\\","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{7FBAC2CF-E843-4C61-B0C5-F7FA3A3BC375}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}]},"mutex_activity":{"mutex_created":[{"name":"SM0:6792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:6792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"SM0:7732:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:7732:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Fixo_Setup","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:7732:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"SM0:6744:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:6744:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-167V6.TMP$DATAFILE.INI","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:4716:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:4716:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:4620:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"SM0:4620:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Global\\C$$PROGRAMDATA$EASEUS$FIXO$ALIYUN$DATAFILE.INI","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"SM0:1900:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:1900:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"SM0:5144:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Local\\SM0:5144:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"}]},{"name":"Global\\C$$PROGRAMDATA$EASEUS$FIXO$ALIYUN$ALIYUNCONFIG.INI","sources":[{"report_type":"sandbox","report_id":"654fc93a9aa903d69d0a53bb"},{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Fixo_Setup","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-AU2TP.TMP$ALIYUNCONFIG.INI","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-AU2TP.TMP$ALIYUNCONFIG.INI","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-AU2TP.TMP$DATAFILE.INI","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-AU2TP.TMP$DATAFILE.INI","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_7b8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"IsoScope_7b8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"IsoScope_7b8_IE_EarlyTabStart_0x7b0_Mutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"IsoScope_7b8_ConnHashTable<1976>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"IsoScope_7b8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_1976","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"IsoScope_7b8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_1976","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_7b8_IE_EarlyTabStart_0x7b0_Mutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_7b8_ConnHashTable<1976>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_7b8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_7b8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\https://www.easeus.com/","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"IsoScope_7b8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://www.easeus.com/","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_7b8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C$$PROGRAMDATA$EASEUS$FIXO$ALIYUN$ALIYUNCONFIG.INI","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C$$PROGRAMDATA$EASEUS$FIXO$ALIYUN$DATAFILE.INI","sources":[{"report_type":"sandbox","report_id":"652af12b8cd2f1d1210d72cc"}]}]}},"report_ids":{"sandbox_job_ids":["654fc93a9aa903d69d0a53bb","652af12b8cd2f1d1210d72cc"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample b8a1a43638c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b8a1a43638c3…. Threat score 100/100. 0/28 AV engines flagged this file. 14 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b8a1a43638c3aa60535b174037eccb242711e0ff03689cacfb9a413da5e38375"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample b8a1a43638c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b8a1a43638c3…. Threat score 100/100. 0/28 AV engines flagged this file. 14 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b8a1a43638c3aa60535b174037eccb242711e0ff03689cacfb9a413da5e38375"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample b8a1a43638c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b8a1a43638c3…. Threat score 100/100. 0/28 AV engines flagged this file. 14 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L88","11",{}]]