24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample fc7c58fa31dd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fc7c58fa31dd…. Malware family: Trojan.Generic. Threat score 100/100. 11/25 AV engines flagged this file. 13 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165"],"about":{"@type":"SoftwareApplication","name":"81585baf1fe72ac76cf5c6dc14ee9dfb.exe","applicationCategory":["peexe","executable"],"identifier":"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":30},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")26:T48c,Found string "system.io.compression.dll" (Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt" (Source: "00000000-00002064.00000001.73714.001F0000.00000004.mdmp") Found string "dd_dotnet48_decompression_log.txt" (Source: "00000000-00002064.00000001.73714.001F0000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp")27:T5cf,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '510064'}" (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '510016'}" (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '509968'}" (UID: 00000000-00005716) "dq1lc64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13092976'}" (UID: 00000000-00005744) "dq1lc64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13092928'}" (UID: 00000000-00005744) "dq1lc64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13092880'}" (UID: 00000000-00005744) "Xj2Ez83.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13879408'}" (UID: 00000000-00005876) "Xj2Ez83.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13879360'}" (UID: 00000000-00005876) "Xj2Ez83.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13879312'}" (UID: 00000000-00005876) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1763377152', 'hResInfo': '1764417912'}" (UID: 00000000-00002160) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1763377152', 'hResInfo': '1764417896'}" (UID: 00000000-00002160)28:T4b2,Found reference to "AesGcm256" (Indicator: "Aes"; File: "00002160.00000870.1939953.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00002160.00000870.1939953.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00002160.00000870.1939953.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00002160.00000870.1939953.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00002160.00000870.1939953.00402000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp")29:T84e,"7nA3nC60.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SHDOCVW.DLL") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED") "7nA3nC60.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS") "7nA3nC60.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\TREATAS") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\TREATAS") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\PROGID") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\PROGID") "7nA3nC60.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "7nA3nC60.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "7nA3nC60.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCHANDLER32") "7nA3nC60.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCHANDLER32")2a:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-15-00D31F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-15-00D31F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-16-00D344B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-16-00D344B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-22-00D3681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-22-00D3681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-26-00D324E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-26-00D324E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-29-00D352B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-29-00D352B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005876-30588-31-00D32390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005876-30588-31-00D32390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-33-00D32F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-33-00D32F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005876-30588-36-00D33BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005876-30588-36-00D33BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-37-00D33FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-37-00D33FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-40-00D32267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-40-00D32267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-41-00D36495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-41-00D36495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-42-00D3202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005876-30588-42-00D3202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-42-00D3202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-43-00D31AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-43-00D31AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-44-00D32AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-44-00D32AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-52-00D34EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-52-00D34EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-57-00D36298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-57-00D36298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-59-00D3621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-59-00D3621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-60-00D3597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-60-00D3597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-62-00D355A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-62-00D355A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-63-00D35467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-63-00D35467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-65-00D353A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-65-00D353A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-66-00D32630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-66-00D32630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-71-00D32CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-71-00D32CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-72-00D318A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-72-00D318A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005876-30588-73-00D317EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005876-30588-73-00D317EE2b:T1df3,Found XOR loop in file "dq1lc64.exe" at offset 193844; code bytes = 30d0 Found XOR loop in file "dq1lc64.exe" at offset 223754; code bytes = 30d0 Found XOR loop in file "dq1lc64.exe" at offset 392229; code bytes = 30d0 Found XOR loop in file "dq1lc64.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "dq1lc64.exe" at offset 363830; code bytes = 33c1 Found XOR loop in file "dq1lc64.exe" at offset 395475; code bytes = 33c1 Found XOR loop in file "dq1lc64.exe" at offset 452965; code bytes = 33c1 Found XOR loop in file "dq1lc64.exe" at offset 547577; code bytes = 33c1 Found XOR loop in file "dq1lc64.exe" at offset 582585; code bytes = 33c1 Found XOR loop in file "dq1lc64.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 142344; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 372237; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 380727; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 491780; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 495762; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 513147; code bytes = 8030 Found XOR loop in file "dq1lc64.exe" at offset 532093; code bytes = 8030 Found XOR loop in file "6nG6RV8.exe" at offset 8308; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8573; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8591; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8621; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8668; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8686; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8709; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8743; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8836; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 8885; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 9494; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 10264; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 10384; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 345329; code bytes = 30d0 Found XOR loop in file "6nG6RV8.exe" at offset 3077; code bytes = 33c1 Found XOR loop in file "6nG6RV8.exe" at offset 3182; code bytes = 33c1 Found XOR loop in file "6nG6RV8.exe" at offset 7470; code bytes = 33c1 Found XOR loop in file "6nG6RV8.exe" at offset 11034; code bytes = 33c1 Found XOR loop in file "6nG6RV8.exe" at offset 131923; code bytes = 33c1 Found XOR loop in file "6nG6RV8.exe" at offset 192722; code bytes = 33c1 Found XOR loop in file "6nG6RV8.exe" at offset 118384; code bytes = 8030 Found XOR loop in file "6nG6RV8.exe" at offset 209996; code bytes = 8030 Found XOR loop in file "6nG6RV8.exe" at offset 345310; code bytes = 8030 Found XOR loop in file "Xj2Ez83.exe" at offset 304557; code bytes = 30d0 Found XOR loop in file "Xj2Ez83.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "Xj2Ez83.exe" at offset 159189; code bytes = 33c1 Found XOR loop in file "Xj2Ez83.exe" at offset 268046; code bytes = 33c1 Found XOR loop in file "Xj2Ez83.exe" at offset 340921; code bytes = 33c1 Found XOR loop in file "Xj2Ez83.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "Xj2Ez83.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "Xj2Ez83.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "Xj2Ez83.exe" at offset 148387; code bytes = 8030 Found XOR loop in file "Xj2Ez83.exe" at offset 178872; code bytes = 8030 Found XOR loop in file "Xj2Ez83.exe" at offset 283388; code bytes = 8030 Found XOR loop in file "1nl94st5.exe" at offset 8308; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8573; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8591; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8621; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8668; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8686; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8709; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8743; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8836; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 8885; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 9494; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 10264; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 10384; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 305393; code bytes = 30d0 Found XOR loop in file "1nl94st5.exe" at offset 3078; code bytes = 33c1 Found XOR loop in file "1nl94st5.exe" at offset 3183; code bytes = 33c1 Found XOR loop in file "1nl94st5.exe" at offset 7470; code bytes = 33c1 Found XOR loop in file "1nl94st5.exe" at offset 11034; code bytes = 33c1 Found XOR loop in file "1nl94st5.exe" at offset 305374; code bytes = 8030 Found XOR loop in file "2GO7700.exe" at offset 1163; code bytes = 30d0 Found XOR loop in file "2GO7700.exe" at offset 2524; code bytes = 30d0 Found XOR loop in file "2GO7700.exe" at offset 25488; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AAA892B.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6AAA892B.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AAA892B.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AAA892B.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 289141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 319075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 487624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 678275; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 213396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 459225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 490878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 548393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 685155; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 707001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 142302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 176181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 237633; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 467632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 476122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 587240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 591222; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 608607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 627561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 641398; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660983; code bytes = 80302c:T5fd,file/memory contains long string with (Indicator: "GetCommandLine"; File: "7nA3nC60.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "DISMHOST.EXE.6AAA892B.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00005780.00001694.1658870.00424000.wprm") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00005780.00001694.1658870.00424000.wprm") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "00002160.00000870.1939953.00402000.wprm") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000940.00000000.71948.00B85000.00000002.mdmp, 00000000-00000940.00000000.71948.00B8D000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000940.00000000.71948.00B85000.00000002.mdmp, 00000000-00000940.00000000.71948.00B8D000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002064.00000001.73714.0040F000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004120.00000001.75224.00901000.00000020.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004192.00000000.72606.00D65000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004192.00000000.72606.00D65000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp")2d:T22fa,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005716) "dq1lc64.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005744) "dq1lc64.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005744) "Xj2Ez83.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005876) "Xj2Ez83.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005876) "1nl94st5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000940) "1nl94st5.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000940) "2GO7700.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006008) "6nG6RV8.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004192) "6nG6RV8.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004192) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002160) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002160) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000014000000000000000000000000000000000000000000000002000002b8dd5b003f00003f0000000000000000000000008000000000000000e94700aec0735d000100000000000000020000000c000000b88d5d00b88d5d00b38d5d000000000000000000000056000000000134f422000000000054fa220095e14c7743af1900feffffff435c50775059507794000000a0000000b28d5d00b08d5d0094000000d8f52200fdfe7e75b8ee22000100000054fa220092e05a6a911f15a1feffffff70f522004c9c5a6a5c0c000084f522005f9c5a6a0000000000000000 (UID: 00000000-00002160)2e:T5e0,"AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006c65436f6e74726f6c7353656374696f6e2c2053797374656d2e5765622e4d6f62696c652c2056657273696f6e3d342e302e302e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d6230336635663766313164353061336122202f3e0d0a20202020 (UID: 00000000-00002160) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f450779f516b774ced22000000c1710000c1710000000000000000f0000000f000c17100000000b8ec2200000000004cee220000000000010000001ced220040f55077000000000000000008ed2200 (UID: 00000000-00002160) "7nA3nC60.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebf975c07d26000040fd7f9a5c517700e0fd7f48cc01014440fd7f00000000400000003f000000260000000040fd7f3ccc0101c15c517760825877260000000040fd7f9a5c517700e0fd7f60cc0101578950778083587713176a75d8ebf975 (UID: 00000000-00002064) "7nA3nC60.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002064)2f:T84e,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "dq1lc64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "dq1lc64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Xj2Ez83.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Xj2Ez83.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1nl94st5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1nl94st5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2GO7700.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6nG6RV8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6nG6RV8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "7nA3nC60.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")30:T524,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00002160-0000010C-1859255 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002160-0000010C-7506088 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002160-0000010C-7516673 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002160-0000010C-9495793 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002160-0000010C-9499972 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002160-0000010C-9989701 "7nA3nC60.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002064-0000010C-14750631:T2e55,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005716) "dq1lc64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005744) "Xj2Ez83.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005876) "1nl94st5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000940) "6nG6RV8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004192) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002160) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002160) "7nA3nC60.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter %TEMP%\is64.bat (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002064) "7nA3nC60.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002064) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002284)32:T89fd,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005716) "dq1lc64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005744) "dq1lc64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005744) "dq1lc64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005744) "dq1lc64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005744) "dq1lc64.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005744) "dq1lc64.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005744) "Xj2Ez83.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005876) "Xj2Ez83.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005876) "Xj2Ez83.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005876) "Xj2Ez83.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005876) "Xj2Ez83.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005876) "Xj2Ez83.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005876) "1nl94st5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000940) "1nl94st5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000940) "1nl94st5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000940) "1nl94st5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000940) "1nl94st5.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000940) "2GO7700.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006008) "2GO7700.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006008) "2GO7700.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006008) "2GO7700.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006008) "2GO7700.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00006008) "6nG6RV8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004192) "6nG6RV8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004192) "6nG6RV8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004192) "6nG6RV8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004192) "6nG6RV8.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004192) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002160) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002160) "7nA3nC60.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002064) "7nA3nC60.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002064) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002284) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00002284)33:T5cd,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00005780.00001694.1658870.00424000.wprm") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00005780.00001694.1658870.00424000.wprm") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000940.00000000.71948.00B85000.00000002.mdmp, 00000000-00000940.00000000.71948.00B8D000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000940.00000000.71948.00B85000.00000002.mdmp, 00000000-00000940.00000000.71948.00B8D000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002064.00000001.73714.0040F000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004120.00000001.75224.00901000.00000020.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00004120.00000001.75224.00901000.00000020.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004192.00000000.72606.00D65000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004192.00000000.72606.00D65000.00000002.mdmp")34:T534,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002064.00000000.73099.001F0000.00000004.mdmp 00000000-00002064.00000001.73714.001F0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002064.00000000.73099.001F0000.00000004.mdmp 00000000-00002064.00000000.73099.01340000.00000002.mdmp 00000000-00002064.00000001.73714.001F0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002064.00000000.73099.001F0000.00000004.mdmp 00000000-00002064.00000001.73714.001F0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002064.00000000.73099.001F0000.00000004.mdmp 00000000-00002064.00000000.73099.01340000.00000002.mdmp 00000000-00002064.00000001.73714.001F0000.00000004.mdmp35:Ta02,"1nl94st5.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "6nG6RV8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]36:T441,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "dq1lc64.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "6nG6RV8.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Xj2Ez83.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1nl94st5.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DISMHOST.EXE.6AAA892B.bin" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE37:T1fcc,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b000000 "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75260000 "dq1lc64.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a510000 "dq1lc64.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69790000 "dq1lc64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75260000 "Xj2Ez83.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b000000 "Xj2Ez83.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75260000 "1nl94st5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75260000 "6nG6RV8.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75260000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a510000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74850000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70da0000 "AppLaunch.exe" loaded module "KERNEL32" at base 757a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64470000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76150000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6b960000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 776e0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 75cb0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 757a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63060000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 75ff0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 752b0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74130000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 727c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6e350000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62600000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 692f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61790000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 772b0000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 74130000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60f70000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6c040000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 607f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 727a0000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 774b0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 765d0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77600000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 753c0000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74ed0000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74dc0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b50000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77660000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71c10000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 75c60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 603d0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5f790000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e3a0000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6a650000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 77680000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 691b0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75690000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5e210000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6b110000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5df30000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5dc20000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 72780000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 67bf0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 68ee0000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 75fb0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74d80000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 748e0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74d70000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5d280000 "7nA3nC60.exe" loaded module "KERNEL32.DLL" at base 757a0000 "7nA3nC60.exe" loaded module "SHELL32.DLL" at base 765d0000 "7nA3nC60.exe" loaded module "OLE32.DLL" at base 75ff0000 "7nA3nC60.exe" loaded module "CRYPTBASE.DLL" at base 752b0000 "7nA3nC60.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74130000 "7nA3nC60.exe" loaded module "ADVAPI32.DLL" at base 772b0000 "7nA3nC60.exe" loaded module "PROPSYS.DLL" at base 73fd0000 "7nA3nC60.exe" loaded module "COMCTL32.DLL" at base 74280000 "7nA3nC60.exe" loaded module "OLEAUT32.DLL" at base 762f0000 "7nA3nC60.exe" loaded module "CLBCATQ.DLL" at base 77220000 "7nA3nC60.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73fd0000 "7nA3nC60.exe" loaded module "NTMARTA.DLL" at base 74820000 "7nA3nC60.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77600000 "7nA3nC60.exe" loaded module "PROFAPI.DLL" at base 753c0000 "7nA3nC60.exe" loaded module "APPHELP.DLL" at base 75260000 "7nA3nC60.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 70460000 "7nA3nC60.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 765d0000 "7nA3nC60.exe" loaded module "SETUPAPI.DLL" at base 75dc0000 "7nA3nC60.exe" loaded module "RPCRT4.DLL" at base 75cb0000 "7nA3nC60.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77360000 "7nA3nC60.exe" loaded module "SECUR32.DLL" at base 750e0000 "7nA3nC60.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 754e0000 "7nA3nC60.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71880000 "7nA3nC60.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75260000 "7nA3nC60.exe" loaded module "DWMAPI.DLL" at base 740d0000 "7nA3nC60.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75ff0000 "7nA3nC60.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76220000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 772b000038:Td07,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165" was detected as "Microsoft Cabinet" and name: "sfx" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165" was detected as "Microsoft Visual C/C++" and name: "Compiler" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165" was detected as "Microsoft Cabinet File" and name: "Archive" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165" was detected as "Microsoft Linker" and name: "Linker" "dq1lc64.exe" was detected as "Microsoft Cabinet" and name: "sfx" "dq1lc64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "dq1lc64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "dq1lc64.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "dq1lc64.exe" was detected as "Microsoft Linker" and name: "Linker" "6nG6RV8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6nG6RV8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6nG6RV8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6nG6RV8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6nG6RV8.exe" was detected as "Microsoft Linker" and name: "Linker" "Xj2Ez83.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Xj2Ez83.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Xj2Ez83.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Xj2Ez83.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Xj2Ez83.exe" was detected as "Microsoft Linker" and name: "Linker" "1nl94st5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1nl94st5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1nl94st5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1nl94st5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1nl94st5.exe" was detected as "Microsoft Linker" and name: "Linker" "7nA3nC60.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7nA3nC60.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7nA3nC60.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7nA3nC60.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7nA3nC60.exe" was detected as "Microsoft Linker" and name: "Linker" "2GO7700.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2GO7700.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2GO7700.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2GO7700.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2GO7700.exe" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6AAA892B.bin" was detected as "Microsoft Cabinet" and name: "sfx" "DISMHOST.EXE.6AAA892B.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6AAA892B.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6AAA892B.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "DISMHOST.EXE.6AAA892B.bin" was detected as "Microsoft Linker" and name: "Linker"39:T1350,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "dq1lc64.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "6nG6RV8.exe" file has an entrypoint instructions - "call 0x402932,jmp 0x4022f2,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021fc,jmp 0x402481,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "Xj2Ez83.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1nl94st5.exe" file has an entrypoint instructions - "call 0x402932,jmp 0x4022f3,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021fd,jmp 0x402482,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "7nA3nC60.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x40f0e8,push 0x40b4fc,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x58,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,call dword ptr [0x40f058],xor edx, edx,mov dl, ah,mov dword ptr [0xf0f874], edx,mov ecx, eax,and ecx, 0xff,mov dword ptr [0xf0f870], ecx,shl ecx, 8,add ecx, edx,mov dword ptr [0xf0f86c], ecx,shr eax, 0x10,mov dword ptr [0xf0f868], eax,xor esi, esi,push esi,call 0x40b3c6,pop ecx,test eax, eax,jne 0x409222," "2GO7700.exe" file has an entrypoint instructions - "call 0x403286,jne 0x40328c,je 0x40328c,jge 0x403298,pop ebx,jmp 0x403299,rol byte ptr [ecx + 0x3286eb], 0,jmp 0x40329d,mov byte ptr [0xa2c0f5eb], al,je 0x4032a7,jne 0x4032a7,xchg esp, eax,mov cl, 0x20,fxch st(4),mov esp, 0x575306a,je 0x4032b0,push edi,lodsb al, byte ptr [esi],sub dword ptr [ebx + 0x548b04c4], eax,and al, 0xfc,jmp 0x4032bf,les ebp, ptr [ecx],shr bl, 5,sub bl, 0xf9,les eax, ptr [eax - 0x4f7ffa15],fsub qword ptr [edi - 0x3d],add eax, dword ptr fs:[edx],je 0x4032d5,jne 0x4032d5,out dx, al,push ds,fcmovne st(0), st(1),push dword ptr [eax + 0xa4],jne 0x4032e2,je 0x4032e2,sub edx, -0x62,add esp, 4," "DISMHOST.EXE.6AAA892B.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"3a:T6c7,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "dq1lc64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "dq1lc64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Xj2Ez83.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Xj2Ez83.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1nl94st5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1nl94st5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2GO7700.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2GO7700.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6nG6RV8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6nG6RV8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7nA3nC60.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7nA3nC60.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7nA3nC60.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3b:T101a,Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005716-00000C2B-117974845] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005716-00000BC1-118122532] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005744-00000BC1-118785461] Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005876.000016F4.596325.00090000.wprm] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005876-00000BC1-119479048] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll" [Source: 00000000-00002160-00000C2B-134179642] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002160-00000C2B-134208996] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002160-00000C2B-134580525] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002160-00000C2B-134628052] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002160-00000C2B-134796635] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002160-00000C2B-134836238] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002160-00000C2B-134879045] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002160-00000C2B-134988933] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002160-00000C2B-135057657] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002160-00000C2B-135091324] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002160-00000C2B-135140479] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00002160-00000C2B-135361291] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002160-00000C2B-135448291] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002160-00000C2B-135469155] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002160-00000C2B-135502240] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002160-00000C2B-135525536] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002160-00000C2B-135632878] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00002160-00000C2B-136578800] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00002160-00000C2B-136665175] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00002160-00000C2B-138446563]3c:T64b,"dq1lc64.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\dq1lc64.exe]- [targetUID: 00000000-00005716] "6nG6RV8.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\IXP001.TMP\6nG6RV8.exe]- [targetUID: 00000000-00004192] "Xj2Ez83.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\Xj2Ez83.exe]- [targetUID: 00000000-00005744] "1nl94st5.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\IXP002.TMP\1nl94st5.exe]- [targetUID: 00000000-00000940] "7nA3nC60.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\IXP000.TMP\7nA3nC60.exe]- [targetUID: 00000000-00005716] "2GO7700.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\2GO7700.exe]- [targetUID: 00000000-00006008] "is64.bat" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%TEMP%\is64.bat]- [targetUID: 00000000-00002064] "dism.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators"- [targetUID: N/A] "DISMHOST.EXE.6AAA892B.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "is64.fil" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\is64.fil]- [targetUID: 00000000-00002284] "is64.txt" has type "very short file (no magic)"- Location: [%TEMP%\is64.txt]- [targetUID: 00000000-00002064]3d:Tb94,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")3e:T10d8,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FC7C58FA31DDE1FE7F032F4BE560539A14130DD0CE74C06825D455D77E016165"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")3f:T499,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\dq1lc64.exe" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\7na3nc60.exe" "dq1lc64.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\xj2ez83.exe" "dq1lc64.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\6ng6rv8.exe" "Xj2Ez83.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\1nl94st5.exe" "Xj2Ez83.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\2go7700.exe" "1nl94st5.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "6nG6RV8.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "7nA3nC60.exe" reads file "c:\windows\system32\shdocvw.dll" "7nA3nC60.exe" reads file "c:\users\%osuser%\appdata\local\temp\is64.bat" "7nA3nC60.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\7na3nc60.exe" "7nA3nC60.exe" reads file "c:\windows\fonts\staticcache.dat" "cmd.exe" reads file "c:\users\%osuser%\appdata\local\temp\is64.bat"40:Tc9a,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe.Local\" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Cabinet.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\VERSION.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\SspiCli.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\WINSPOOL.DRV" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\MPR.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\MPR.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\UxTheme.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\WINMM.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\samcli.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\samcli.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\MSACM32.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"41:Td26,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\Cabinet.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\VERSION.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\SspiCli.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\MPR.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\UxTheme.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\WINMM.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\samcli.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\MSACM32.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\sfc.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\sfc_os.DLL" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\dwmapi.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\dq1lc64.exe" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7nA3nC60.exe" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\FLTLIB.DLL" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\MSVCP140.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\ucrtbase.DLL" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"42:T87a,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe.Local\" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe.Config" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\FC7C58FA31DDE1FE7F032F4BE560539A14130DD0CE74C06825D455D77E016165.EXE.LOCAL" "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" trying to access non-existent file "C:\FC7C58FA31DDE1FE7F032F4BE560539A14130DD0CE74C06825D455D77E016165.EXE.CONFIG" "dq1lc64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\dq1lc64.exe.Local\" "dq1lc64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "dq1lc64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\dq1lc64.exe.Config" "dq1lc64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "dq1lc64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\DQ1LC64.EXE.LOCAL" "dq1lc64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\DQ1LC64.EXE.CONFIG" "Xj2Ez83.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Xj2Ez83.exe.Local\" "Xj2Ez83.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "Xj2Ez83.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Xj2Ez83.exe.Config" "Xj2Ez83.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"43:T6fc,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "FindNextFileW" with parameter 7nA3nC60.exe (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "FindNextFileW" with parameter dq1lc64.exe (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00005716) "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005716) "dq1lc64.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00005744) "dq1lc64.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005744) "dq1lc64.exe" called "FindNextFileW" with parameter 6nG6RV8.exe (UID: 00000000-00005744) "dq1lc64.exe" called "FindNextFileW" with parameter Xj2Ez83.exe (UID: 00000000-00005744) "dq1lc64.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00005744) "dq1lc64.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005744) "Xj2Ez83.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00005876) "Xj2Ez83.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005876) "Xj2Ez83.exe" called "FindNextFileW" with parameter 1nl94st5.exe (UID: 00000000-00005876) "Xj2Ez83.exe" called "FindNextFileW" with parameter 2GO7700.exe (UID: 00000000-00005876)44:Td52,Found string "FromBase64" (Indicator: "base64"; File: "00002160.00000870.1939953.00402000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00002160.00000870.1939953.00402000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00002160.00000870.1939953.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00002160.00000870.1939953.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00002160.00000870.1939953.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00002160.00000870.1939953.00402000.wprm") Found string "base64str" (Indicator: "base64"; File: "00002160.00000870.1939953.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00002160.00000870.1939953.00402000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00002160.00000870.1939953.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00002160.00000870.1939953.00402000.wprm") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004192.00000000.72606.00D6D000.00000004.mdmp")45:T110c,Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\1nl94st5.exe" (Indicator: "\Device\"; Source: "00000000-00000940.00000000.71829.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.73099.001F0000.00000004.mdmp, 00000000-00002064.00000001.73714.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.73099.001F0000.00000004.mdmp, 00000000-00002064.00000001.73714.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.73099.001F0000.00000004.mdmp, 00000000-00002064.00000001.73714.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.73099.001F0000.00000004.mdmp, 00000000-00002064.00000001.73714.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.73099.001F0000.00000004.mdmp, 00000000-00002064.00000001.73714.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.73099.001F0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000001.73714.001F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\154DE6DD-30B9-418B-920F-6981ECCD58B8\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00004120.00000000.74383.00270000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004120.00000001.75224.002BA000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004120.00000001.75224.002BA000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\6nG6RV8.exe" (Indicator: "\Device\"; Source: "00000000-00004192.00000000.72606.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005716.00000000.71628.00190000.00000004.mdmp, 00000000-00005716.00000001.73552.00190000.00000004.mdmp, 00000000-00005716.00000002.73721.00190000.00000004.mdmp")46:T1829,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: dq1lc64.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: dq1lc64.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: dq1lc64.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: dq1lc64.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: dq1lc64.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 6nG6RV8.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 6nG6RV8.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Xj2Ez83.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Xj2Ez83.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Xj2Ez83.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Xj2Ez83.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Xj2Ez83.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 1nl94st5.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 1nl94st5.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6AAA892B.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6AAA892B.bin]47:T40f,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "dq1lc64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "Xj2Ez83.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "7nA3nC60.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "7nA3nC60.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000")48:T47a,Found string "CheckTokenMembership" (Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165, API is part of module: ADVAPI32.DLL) Found string "DelNodeRunDLL32" (Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165, API is part of module: ADVPACK.DLL) Found string "HeapSetInformation" (Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165, API is part of module: KERNELBASE.DLL) Found string "DecryptFileA" (Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165, API is part of module: ADVAPI32.DLL) Found string "DoInfInstall" (Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165, API is part of module: ADVPACK.DLL) Found string "SHBrowseForFolder" (Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165, API is part of module: SHELL32.DLL) Found string "SHGetPathFromIDList" (Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165, API is part of module: SHELL32.DLL) Found string "Extract" (Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165, API is part of module: URLMON.DLL)49:T457,"dq1lc64.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\dq1lc64.exe]- [targetUID: 00000000-00005716] "6nG6RV8.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\IXP001.TMP\6nG6RV8.exe]- [targetUID: 00000000-00004192] "Xj2Ez83.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\Xj2Ez83.exe]- [targetUID: 00000000-00005744] "1nl94st5.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\IXP002.TMP\1nl94st5.exe]- [targetUID: 00000000-00000940] "7nA3nC60.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\IXP000.TMP\7nA3nC60.exe]- [targetUID: 00000000-00005716] "2GO7700.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\2GO7700.exe]- [targetUID: 00000000-00006008] "DISMHOST.EXE.6AAA892B.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A]4a:T436,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "dq1lc64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "dq1lc64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "Xj2Ez83.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Xj2Ez83.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"")4b:T9cb,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\dq1lc64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7nA3nC60.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "dq1lc64.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Xj2Ez83.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "dq1lc64.exe" wrote 18432 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6nG6RV8.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Xj2Ez83.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\1nl94st5.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Xj2Ez83.exe" wrote 19968 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\2GO7700.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ...4c:T537,"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7nA3nC60.exe" with delete access "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\dq1lc64.exe" with delete access "dq1lc64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "dq1lc64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "dq1lc64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6nG6RV8.exe" with delete access "dq1lc64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Xj2Ez83.exe" with delete access "Xj2Ez83.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "Xj2Ez83.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Xj2Ez83.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Xj2Ez83.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\2GO7700.exe" with delete access "Xj2Ez83.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\1nl94st5.exe" with delete access4d:T632,Wrote 112 instructions to a remote process Wrote 73 instructions to a remote process Wrote 2 instructions to a remote process Wrote 89 instructions to a remote process Wrote 10 instructions to a remote process Wrote 94 instructions to a remote process Wrote 42 instructions to a remote process Wrote 12 instructions to a remote process Wrote 22 instructions to a remote process Wrote 23 instructions to a remote process Wrote 57 instructions to a remote process Wrote 13 instructions to a remote process Wrote 74 instructions to a remote process Wrote 27 instructions to a remote process Wrote 20 instructions to a remote process Wrote 5 instructions to a remote process Wrote 9 instructions to a remote process Wrote 67 instructions to a remote process Wrote 21 instructions to a remote process Wrote 11 instructions to a remote process Wrote 24 instructions to a remote process Wrote 87 instructions to a remote process Wrote 7 instructions to a remote process Wrote 54 instructions to a remote process Wrote 30 instructions to a remote process Wrote 46 instructions to a remote process Wrote 17 instructions to a remote process Wrote 113 instructions to a remote process Wrote 65 instructions to a remote process Wrote 19 instructions to a remote process Wrote 40 instructions to a remote process Wrote 88 instructions to a remote process Wrote 48 instructions to a remote process Wrote 16 instructions to a remote process Wrote 39 instructions to a remote process Wrote 25 instructions to a remote process Wrote 4 instructions to a remote process4e:T7d6,"" (Indicator: "MoveFileA"; Source: "00000000-00006212.00000000.69397.02A50000.00000004.mdmp, 00000000-00006212.00000001.69449.02A50000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00006212.00000000.69397.02A50000.00000004.mdmp, 00000000-00006212.00000001.69449.02A50000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00006212.00000000.69397.02A50000.00000004.mdmp, 00000000-00006212.00000001.69449.02A50000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00006212.00000000.69397.02A50000.00000004.mdmp, 00000000-00006212.00000001.69449.02A50000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00006692.00000001.71121.03220000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00006692.00000001.71121.03220000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00006692.00000001.71121.03220000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00006692.00000001.71121.03220000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00006792.00000001.71201.03270000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00006792.00000001.71201.03270000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00006792.00000001.71201.03270000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00006792.00000001.71201.03270000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00007068.00000000.69342.00650000.00000004.mdmp, 00000000-00007068.00000001.71262.00650000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00007068.00000000.69342.00650000.00000004.mdmp, 00000000-00007068.00000001.71262.00650000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00007068.00000000.69342.00650000.00000004.mdmp, 00000000-00007068.00000001.71262.00650000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00007068.00000000.69342.00650000.00000004.mdmp, 00000000-00007068.00000001.71262.00650000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00008164.00000000.69773.02E80000.00000004.mdmp, 00000000-00008164.00000002.73613.02E80000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00008164.00000000.69773.02E80000.00000004.mdmp, 00000000-00008164.00000002.73613.02E80000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00008164.00000000.69773.02E80000.00000004.mdmp, 00000000-00008164.00000002.73613.02E80000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00008164.00000000.69773.02E80000.00000004.mdmp, 00000000-00008164.00000002.73613.02E80000.00000004.mdmp")50:Tfde,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006212.00000000.69397.02A50000.00000004.mdmp, 00000000-00006212.00000001.69449.02A50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006212.00000000.69397.02A50000.00000004.mdmp, 00000000-00006212.00000001.69449.02A50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006212.00000000.69397.02A50000.00000004.mdmp, 00000000-00006212.00000001.69449.02A50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006212.00000000.69397.02A50000.00000004.mdmp, 00000000-00006212.00000001.69449.02A50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006692.00000001.71121.03220000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006692.00000001.71121.03220000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006692.00000001.71121.03220000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006692.00000001.71121.03220000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006792.00000001.71201.03270000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006792.00000001.71201.03270000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006792.00000001.71201.03270000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006792.00000001.71201.03270000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007068.00000000.69342.00650000.00000004.mdmp, 00000000-00007068.00000001.71262.00650000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007068.00000000.69342.00650000.00000004.mdmp, 00000000-00007068.00000001.71262.00650000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007068.00000000.69342.00650000.00000004.mdmp, 00000000-00007068.00000001.71262.00650000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007068.00000000.69342.00650000.00000004.mdmp, 00000000-00007068.00000001.71262.00650000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008164.00000000.69773.02E80000.00000004.mdmp, 00000000-00008164.00000002.73613.02E80000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008164.00000000.69773.02E80000.00000004.mdmp, 00000000-00008164.00000002.73613.02E80000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008164.00000000.69773.02E80000.00000004.mdmp, 00000000-00008164.00000002.73613.02E80000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008164.00000000.69773.02E80000.00000004.mdmp, 00000000-00008164.00000002.73613.02E80000.00000004.mdmp")51:T5dd,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00006212.00000000.69397.008C5000.00000002.mdmp, 00000000-00006212.00000000.69397.008CD000.00000004.mdmp, 00000000-00006212.00000001.69449.008CD000.00000004.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006692.00000001.71121.003CA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006692.00000001.71121.003CA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006792.00000001.71201.0025A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006792.00000001.71201.0025A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00007068.00000001.71262.008FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007068.00000001.71262.008FA000.00000002.mdmp")52:T6cf,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006692.00000001.71121.003CA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006692.00000001.71121.003CA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006692.00000001.71121.003CA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006792.00000001.71201.0025A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006792.00000001.71201.0025A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006792.00000001.71201.0025A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007068.00000001.71262.008FA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007068.00000001.71262.008FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007068.00000001.71262.008FA000.00000002.mdmp")53:T5b8," Microsoft Corporation\"\n \"Xj2Ez83.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"1nl94st5.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"7nA3nC60.exe\" was detected as \"Microsoft Visual C++ 5.0\"\n \"2GO7700.exe\" was detected as \"Safeguard v1.03 -> Simonzh\"\n \"DISMHOST.EXE.6AAA892B.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"register-cimprovider.exe\" (Indicator: \"register-cimprovider.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"7nA3nC60.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165\" has section name .rsrc with entropy \"7.921208526468369\"\n \"dq1lc64.exe\" has section name .rsrc with entropy \"7.893983424484497\"\n \"Xj2Ez83.exe\" has section name .rsrc with entropy \"7.754002415295203\"\n \"2GO7700.exe\" has section name .text with entropy \"7.044636590269497\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00000940-31108-224-00B72C65\n cpuid at 00000000-00005780-31715-273-00420CA3\n cpuid at 00000000-00005780-31715-301-00401855\n cpuid at 00000000-00004192-32775-224-00D52C65","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query security token membership for user discovery","description":"Observed token membership api used in \"advapi32.dll\" [Source: fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165]\n Observed token membership api used in \"advapi32.dll\" [Source: dq1lc64.exe]\n Observed token membership api used in \"advapi32.dll\" [Source: Xj2Ez83.exe]","origin":"Static Parser","mitre_attack_id":"T1033","relevance":3,"id":"static-210","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00005876-30588-14-00D32BFB\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005876-30588-87-00D36FBE\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00000940-31108-79-00B780DE\n GetModuleHandleW@KERNEL32.DLL at 00000000-00000940-31108-93-00B78079\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00000940-31108-419-00B77379\n GetModuleHandleW@KERNEL32.DLL at 00000000-00000940-31108-645-00B72B15\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00004192-32775-79-00D580DE\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004192-32775-93-00D58079\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00004192-32775-419-00D57379\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004192-32775-654-00D52B15","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00005876-30588-11-00D36A60\n GetStartupInfoW@KERNEL32.DLL at 00000000-00000940-31108-535-00B799C0\n GetStartupInfoW@KERNEL32.DLL at 00000000-00004192-32775-535-00D599C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00005876-30588-22-00D3681F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve volume information","description":"GetVolumeInformationA@KERNEL32.DLL at 00000000-00005876-30588-60-00D3597D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-130","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/24 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00005876-30588-35-00D3468F\n FindResourceA@KERNEL32.DLL at 00000000-00005876-30588-51-00D34FE0\n LoadResource@KERNEL32.DLL at 00000000-00005876-30588-57-00D36298\n FindResourceA@KERNEL32.DLL at 00000000-00005876-30588-58-00D36517\n FindResourceA@KERNEL32.DLL at 00000000-00005876-30588-71-00D32CAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"7nA3nC60.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$49","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$4b","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"Network Related","name":"Able to retrieve local network connections","description":"Found string \"nbtstat.exe\" (Indicator: \"nbtstat\"; Source: \"00000000-00002064.00000000.73099.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-361","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" connects to 5.42.92.51 on port 19057 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00002064\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"2GO7700.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\7nA3nC60.exe\" for deletion\n \"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\dq1lc64.exe\" for deletion\n \"dq1lc64.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\6nG6RV8.exe\" for deletion\n \"dq1lc64.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\Xj2Ez83.exe\" for deletion\n \"Xj2Ez83.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP002.TMP\\2GO7700.exe\" for deletion\n \"Xj2Ez83.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP002.TMP\\1nl94st5.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$4c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"7nA3nC60.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"7nA3nC60.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"dq1lc64.exe\" claimed CRC 763907 while the actual is CRC 612716\n \"6nG6RV8.exe\" claimed CRC 612716 while the actual is CRC 358355\n \"1nl94st5.exe\" claimed CRC 366864 while the actual is CRC 340809\n \"DISMHOST.EXE.6AAA892B.bin\" claimed CRC 94017 while the actual is CRC 103114","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n OpenProcessToken\n RegCloseKey\n RegCreateKeyExA\n RegDeleteValueA\n CreateDirectoryA\n GetSystemDirectoryA\n TerminateProcess\n FindResourceA\n CreateFileA\n GetVersionExA\n DeleteFileA\n GetSystemInfo\n GetModuleHandleW\n GetFileAttributesA\n LoadLibraryA\n FindNextFileA\n Sleep\n GetTempFileNameA\n LoadLibraryExA\n GetProcAddress\n CreateProcessA\n GetDriveTypeA\n GetTickCount\n GetModuleFileNameA\n FindFirstFileA\n GetStartupInfoW\n GetTempPathA\n WriteFile\n CreateThread\n UnhandledExceptionFilter\n LockResource\n ExitThread\n LoadLibraryExW\n CreateFileW\n GetModuleHandleExW\n GetModuleFileNameW\n GetCommandLineW\n FindNextFileW\n VirtualAlloc\n IsDebuggerPresent\n GetFileSizeEx\n FindFirstFileExW\n GetCommandLineA\n GetStartupInfoA\n GetModuleHandleA\n ShellExecuteExA\n RegOpenKeyExW\n SetSecurityDescriptorDacl\n OutputDebugStringW\n CreateFileMappingW\n GetVersionExW\n FindResourceExW\n GetSystemDirectoryW\n OutputDebugStringA\n GetFileAttributesW\n MapViewOfFile\n LoadLibraryW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$4d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"13/27 Antivirus vendors marked dropped file \"2GO7700.exe\" as malicious (classified as \"Smokeloader.b\" with 48% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"13/27 Antivirus vendors marked spawned process \"2GO7700.exe\" (PID: 6008) as malicious (classified as \"Smokeloader.b\" with 48% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"},{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 5.42.92.51 on port 19057","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"fc7c58fa31dde1fe7f032f4be560539a14130dd0ce74c06825d455d77e016165.exe\" (UID: 00000000-00005716)\n Spawned process \"dq1lc64.exe\" (UID: 00000000-00005744)\n Spawned process \"Xj2Ez83.exe\" (UID: 00000000-00005876)\n Spawned process \"1nl94st5.exe\" (UID: 00000000-00000940)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00005780)\n Spawned process \"2GO7700.exe\" (UID: 00000000-00006008)\n Spawned process \"6nG6RV8.exe\" (UID: 00000000-00004192)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00002160)\n Spawned process \"7nA3nC60.exe\" (UID: 00000000-00002064)\n Spawned process \"cmd.exe\" with commandline \"/c \"\"%TEMP%\\\\is64.bat\" \"\" (UID: 00000000-00002284)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aaa6bfe093a5c2792039fab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$4e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00006212.00000000.69397.02A50000.00000004.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00006212.00000000.69397.02A50000.00000004.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00006212.00000000.69397.02A50000.00000004.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00006212.00000000.69397.02A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"K32EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; Source: \"00000000-00006212.00000000.69397.02A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69ba8fb20f7773ee11070764"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"