26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 68:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ffeeafbe114f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ffeeafbe114f…. Malware family: Trojan.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6"],"about":{"@type":"SoftwareApplication","name":"03e0d9b601defd28ce944f96c8a0ad5b.exe","applicationCategory":["peexe","executable"],"identifier":"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T71e,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "remcmdstub.exe.3754310044") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "WaitForSingleObject timed out in co_wsend, timeout %d, last error %d" (Indicator: "WaitForSingleObject"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")28:T766,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")29:T6bc,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")2a:T5c1,Found reference to "SnmpUtilOidNCmp" (Indicator: "Oid"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp") Found reference to "SnmpUtilOidCpy" (Indicator: "Oid"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp") Found reference to ".?AVSHA512@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003320.00000000.77878.72212000.00000004.mdmp") Found reference to ".?AV?$IteratedHashWithStaticTransform@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@$0EA@VSHA512@2@$0EA@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003320.00000000.77878.72212000.00000004.mdmp") Found reference to ".?AV?$ClonableImpl@VSHA512@CryptoPP@@V?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003320.00000000.77878.72212000.00000004.mdmp") Found reference to ".?AV?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003320.00000000.77878.72212000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00003320.00000000.77878.72212000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003320.00000000.77878.72212000.00000004.mdmp")2b:T705,Contains long base64 encoded string "yyyyM/d/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySundayam/pmSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecIsDBCSLeadByteCompareStringALoadLibraryAFreeLibraryGetProcAddressGetModuleHandleAGetModuleFileNameAOutputDebugStringAExitProcessSetLastErrorGetLastErrorCloseHandleOpenProcessGetCurrentProcessIdGetVersionExAGetLocalTimeGetTempPathAGetCurrentThreadIdGetTickCountCreateEventAInterlockedIncrementDisableThreadLibraryCallsCreateThreadInitializeCriticalSectionDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionWaitForSingleObjectSleepSetEventInterlockedDecrementKERNEL32" in [Source : pcicapi.dll] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" in [Source : ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" in [Source : 00000000-00003320.00000000.77878.0044D000.00000002.mdmp]2c:T12c4,Assembly shows XOR instruction xor eax ebp in Stream UID: 48455-1570-00422759 Assembly shows XOR instruction xor eax ebp in Stream UID: 48455-190-00420DDA Assembly shows XOR instruction xor ecx ebp in Stream UID: 48455-190-00420DDA Assembly shows XOR instruction xor eax ebp in Stream UID: 48455-95-00422D73 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48455-95-00422D73 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-202-00424252 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-202-00424252 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-612-00422759 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-96-00424BAB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-96-00424BAB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-192-0042176F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-192-0042176F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-190-00420DDA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-190-00420DDA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-95-00422D73 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-95-00422D73 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-193-00424799 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-193-00424799 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-16-0041F3AC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-16-0041F3AC Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00003320-53303-241-00422575 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003320-53303-241-00422575 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00003320-53303-241-00422575 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-196-00424750 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-196-00424750 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003320-53303-188-0042108D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003320-53303-188-0042108D Assembly shows XOR instruction xor byte ptr [eax] bl in Stream UID: 00000000-00003320-53303-173-0040CABA Assembly shows XOR instruction xor eax ebp in Stream UID: 57110-32-1017A907 Assembly shows XOR instruction xor ecx ebp in Stream UID: 57110-32-1017A907 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 57110-61-101837E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 57110-61-101837E0 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 57110-24-1017AB80 Assembly shows XOR instruction xor eax edx in Stream UID: 57110-24-1017AB80 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 57110-22-1017EA40 Assembly shows XOR instruction xor eax ebp in Stream UID: 57110-22-1017EA40 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 58196-61-101DD380 Assembly shows XOR instruction xor eax ebp in Stream UID: 58196-61-101DD380 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 58196-22-101D6AB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58196-22-101D6AB0 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 58196-24-101D8A50 Assembly shows XOR instruction xor eax edx in Stream UID: 58196-24-101D8A50 Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 59215-1-00401020 Assembly shows XOR instruction xor dword ptr [edx] esi in Stream UID: 59215-1-00401020 Assembly shows XOR instruction xor byte ptr [eax] dh in Stream UID: 59215-1-00401020 Assembly shows XOR instruction xor bl byte ptr [edx+edx*2+65h] in Stream UID: 59215-1-00401020 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 59215-1-00401020 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 59215-9-00418E20 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 59215-6-00419C04 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 59215-6-00419C04 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 59215-6-00419C04 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 59215-6-00419C04 Assembly shows XOR instruction xor byte ptr [eax] dh in Stream UID: 59215-6-00419C042d:T2436,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000040e7b40038cf69775c34c902ace7b400010000001034c9025c34c9021034c902040000000400000000e0087700100000ace7b400010000001034c902cd9769779c976977e8ba4947b50fff761034c90200006977000000004cfb53760000000080ee05770100000000000000f8e20877000000000400000080a9fe7348400777f8e20877b0e7b40080e8da7450f1c90280e8da74ace7b4000000000080e8da74446ce4fdfeffffff00000000000000000000000005000000f07bd00202000000020000000a000000e07bd002f07bd00200000000e45396b630eab400ddf3fc7624e8b40000000000e07bd0020a000000f8f3fc76e07bd002 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000006dce02146dce02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000657224e6b400d89cd0020000000050a0c97400000000000000000000c90200000000d89cd002c0e4b4006c646572d89cd002000000000000000028071807d89cd00228e5b400f40d6572d89cd00200000000000000000000b40000000000a41751e10000000054e5b40058e5b40024e6b400600f00001000000014e5b40052436c774300000068e5b40073f6fc76e6e5b4005c000000000000001bffff7f82f8fc7600000000b498e6fdffffffff00000000000000000000000009000000444dce0201000000010000002b000000f04cce02444dce0200000000645196b6b0e7b400ddf3fc76a4e5b40000000000f04cce022b000000f8f3fc76f04cce02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000013002010bc0264000000fd3edf741ce4b400f0fbfe76fc9925c1feffffff28e4b40028e4b400b6a2d9740000c902000000007095ce0228e4b4004c87df745c87df7474feed89f890ce0200000000f057ce02f057ce020000ce02e819ce027095ce02cce7b40000000000280718075c87df74af84df7460a1ce02f057ce020000000000000000807fdf74b485df749ce4b40000000000000000005e8dd901d857ce0260a1ce02e819ce0228071807f0e8b400cce8b40081f12a752807180708eeb40098eab400c5f12a750000c9029834697748acce02f8e8b4001c60277504000000f0e8b4005c83cf7420071807a0902e7500000000c0e4b4006c646572 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020deb400bf2a69774d336977048d49479c0000000000c90270deb400000000000000000000000000000000000200000200000000623e005c000000009806009e0000000000000000000000000200000200000000623e005c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b0d4ca02c8d4ca02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000006bece021cbece02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007eb7ce0296b7ce02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003efbce0254fbce02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e6f5ce02fef5ce02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028071807000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008ce3b40052436c7743000000e0e3b40073f6fc7622e4b4005c00000000000000fdfeff7f82f8fc76000000007415e7fdfeffffff00000000000000000000000005000000b8cecd0202000000020000000a000000a8cecd02b8cecd0200000000ec5796b628e6b400ddf3fc761ce4b40000000000a8cecd020a000000f8f3fc76a8cecd02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000586ace026c6ace02 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d0100000000000000a8e2b400854ae774df87df74f4f8ed89e819ce02f0aace02e819ce02f0aace02a4cfce746234f1ee04e2b400000000000000000000000000e23a239cfeffffff0000b400881afd76b31afd76e819ce021895ce020000000000000000280718078b84df74330000000cfced89ace6b40000000000000000000000000000000000000000005e8dd90150c0ce02f0aace02e819ce022807180768e7b40044e7b40081f12a752807180780ecb40010e9b400c5f12a750000c9029834697708c7d00270e7b4001c6027750400000068e7b4005c83cf7420071807a0902e75000000000000000000000000 (UID: 00000000-00003320)2e:T11fe,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000a80bbc02637a687770f0b700591669770100000008000000010000000000c9020000000010000000000000000000000002000000020000000000c90201000000080000000000000090f0b700ee13697701000000ee13697708000000000000000800000001000000c8f2b700ad9c5b720000c9020800000001000000 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f02300000200000000000000ffffffffffffffff10b5b40000000000000000000000000018b5b400000000000010000000000000040000000000000058eaf071ee63f1ee00200000a0b5b400012ffe76ffffffff9cb5b4000000000098b5b400001000000400000070689e740020000000009d07d8b5b4000000b8006ee9f07100009d07ff000000 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000002300000200000000000000ffffffffffffffff10b5b40000000000000000000000000018b5b400000000000010000000000000040000000000000058eaf071ee63f1ee00200000a0b5b400012ffe76ffffffff9cb5b4000000000098b5b400001000000400000070689e740020000000009d07d8b5b4000000b8006ee9f071 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000023000002000000002300000200000000000000ffffffffffffffff10b5b40000000000000000000000000018b5b400000000000010000000000000040000000000000058eaf071ee63f1ee00200000a0b5b400012ffe76ffffffff9cb5b4000000000098b5b400001000000400000070689e740020000000009d07d8b5b400 (UID: 00000000-00003320) "client32.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f02300000200000000000000000000002f0084e30000000054f5f50097096b77ffffffff2400000050f5f5000400000020000000414e4e2594f7f500588afe762027a7922010bb008138180300f0d80098455aaa0000f8710020350000000001a400a60084f5f5005c004400650076006900630065005c0048006100720064006400690073006b00 (UID: 00000000-00003968) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003968) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000c0000000000180340f4f5000000000000000000000000000000000000000000d0070803180000000000000003000000000008033f0784e32b006572a026f5002a000000d8001b0358a61a0303000000000000002000000000000803c40108033c09080300000000380908030000000038f4f50059166977 (UID: 00000000-00003968) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000029fe71341f6f054c1f6f0535c74301341f6f0500000000f8f0f50060affd71f8a01072bd3d10723cf1f50010000000040000003cf1f500cca410720100000018f1f5005ec7fd71f8a01072bd3d10723cf1f50010000000000000000400000050f1f5005f78fd71f8a01072bc3d10723cf1f50010000000585119d784f4f500 (UID: 00000000-00003968) "client32.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f023000002000000000000000000000004f5a30048812d16000000000cf5a30097096b77ffffffff2400000008f5a3000400000020000000d72f6b1648f7a300588afe762cae5fd62010bb005936f2020050c000ce4ed56d00005b710020350000000001a400a6003cf5a3005c004400650076006900630065005c00480061007200640064006900 (UID: 00000000-00006980) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006980) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000c0000000000f202f8f3a3000000000000000000000000000000000000000000d007af0018000000000000006f0000000000af0058862d1686002a715826a3000a000000907df602707ef4021b00000000000000200000000000af00c401af003c09af00000000003809af0014000000f0f3a300 (UID: 00000000-00006980) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000296171142548052c254805333244011425480500000000acf0a30060af6071f8a07371bd3d7371f0f0a3001000000004000000f0f0a300cca4737101000000ccf0a3005ec76071f8a07371bd3d7371f0f0a30010000000000000000400000004f1a3005f786071f8a07371bc3d7371f0f0a300100000004136006538f4a300 (UID: 00000000-00006980)2f:T424,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp")30:T4b1,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp")31:T72c,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp")32:T5e3,Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "TCCTL32.DLL.925006637") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "remcmdstub.exe.3754310044") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003320.00000000.77878.72461000.00000020.mdmp")33:T424,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp")34:T5da,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "remcmdstub.exe.3754310044") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")35:T46ce,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenSection" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtCreateSection" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryInformationToken" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenKeyEx" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryValueKey" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtSetInformationKey" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryInformationFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtEnumerateKey" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryKey" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtEnumerateValueKey" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtProtectVirtualMemory" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThread" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtResumeThread" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryVolumeInformationFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtSetInformationProcess" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LdrGetDllHandle" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LdrLoadDll" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadLibrary" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryVirtualMemory" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtAllocateVirtualMemory" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryInformationProcess" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQuerySystemInformation" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtCreateEvent" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtConnectPort" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtRequestWaitReplyPort" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryDefaultLocale" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetVersionExA" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtReadFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenEvent" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtWaitForMultipleObjects" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtNotifyChangeKey" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenDirectoryObject" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenMutant" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtCreateMutant" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtCreateThreadEx" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtAlpcConnectPort" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtAlpcSendWaitReceivePort" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RpcStringBindingComposeW" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtAlpcConnectPortEx" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryObject" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryLicenseValue" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtCreateKeyEx" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtSetValueKey" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtCreateFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtSetInformationFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtWriteFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtSetInformationThread" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "SetFileTime" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FileTimeToLocalFileTime" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FileTimeToSystemTime" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtDeviceIoControlFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LdrUnloadDll" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtFsControlFile" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcess" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "CryptAcquireContextA" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RpcServerUseProtseqEpW" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQuerySystemTime" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtCreateUserProcess" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LdrGetProcedureAddress" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtWriteVirtualMemory" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtTerminateProcess" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetNtProductType" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "RtlGetVersion" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindResourceW" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetSystemDefaultLangID" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetWindowTextW" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindWindowExW" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetKeyState" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "CreateDirectoryW" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetComputerNameW" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "IsWow64Process" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadResource" (PID: 3320) (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetForegroundWindow" (PID: 3320) (UID: 00000000-00003320) "client32.exe" called "NtOpenSection" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtCreateSection" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryInformationToken" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtOpenKeyEx" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryValueKey" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtSetInformationKey" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtOpenFile" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryInformationFile" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtEnumerateKey" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryKey" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtEnumerateValueKey" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtProtectVirtualMemory" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtOpenThread" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtResumeThread" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryInformationProcess" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtAllocateVirtualMemory" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryAttributesFile" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "LdrLoadDll" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtMapViewOfSection" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryVolumeInformationFile" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtSetInformationProcess" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "LdrGetDllHandle" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryVirtualMemory" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtCreateEvent" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "GetVersionExA" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQuerySystemInformation" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtDelayExecution" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtSuspendThread" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtGetContextThread" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtOpenEvent" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtCreateThreadEx" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtConnectPort" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtRequestWaitReplyPort" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtOpenProcessToken" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtReadFile" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryDefaultLocale" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtQueryLicenseValue" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "LdrUnloadDll" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtCreateMutant" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtWaitForMultipleObjects" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtDeviceIoControlFile" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "SetupDiGetClassDevsA" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtOpenProcess" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtReadVirtualMemory" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtCreateFile" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtPowerInformation" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtCreateUserProcess" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "NtTerminateProcess" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "RtlGetNtProductType" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "RtlGetVersion" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "GetNativeSystemInfo" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "CreateToolhelp32Snapshot" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "GetLocaleInfoA" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "GetLocaleInfoW" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "FindWindowExW" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "GetDriveTypeA" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "GetComputerNameA" (PID: 3968) (UID: 00000000-00003968) "client32.exe" called "GetComputerNameW" (PID: 3968) (UID: 00000000-00003968) "WerFault.exe" called "NtTerminateProcess" (PID: 6456) (UID: 00000000-00006456) "client32.exe" called "NtOpenSection" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtCreateSection" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryInformationToken" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtOpenKeyEx" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryValueKey" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtOpenFile" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtSetInformationKey" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryInformationFile" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtEnumerateKey" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryKey" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtEnumerateValueKey" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtProtectVirtualMemory" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtOpenThread" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtResumeThread" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryAttributesFile" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtMapViewOfSection" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryVolumeInformationFile" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtSetInformationProcess" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "LdrLoadDll" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "LdrGetDllHandle" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryVirtualMemory" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtAllocateVirtualMemory" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryInformationProcess" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtCreateEvent" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "GetVersionExA" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtDelayExecution" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQuerySystemInformation" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtSuspendThread" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtGetContextThread" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtOpenEvent" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtCreateThreadEx" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtConnectPort" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtRequestWaitReplyPort" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtOpenProcessToken" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtReadFile" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryDefaultLocale" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtQueryLicenseValue" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "LdrUnloadDll" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtCreateMutant" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtWaitForMultipleObjects" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtDeviceIoControlFile" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "SetupDiGetClassDevsA" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtSetInformationThread" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtOpenProcess" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtReadVirtualMemory" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtCreateFile" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtPowerInformation" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtCreateUserProcess" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "NtTerminateProcess" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "RtlGetNtProductType" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "RtlGetVersion" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "GetNativeSystemInfo" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "CreateToolhelp32Snapshot" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "GetLocaleInfoA" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "GetLocaleInfoW" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "FindWindowExW" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "GetDriveTypeA" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "GetComputerNameA" (PID: 6980) (UID: 00000000-00006980) "client32.exe" called "GetComputerNameW" (PID: 6980) (UID: 00000000-00006980) "WerFault.exe" called "NtTerminateProcess" (PID: 6852) (UID: 00000000-00006852)36:Tf51,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadLibrary" with a parameter riched32.dll (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadLibrary" with a parameter riched20.dll (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00003320) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\UpdatSupport1523\dbghelp.dll (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter DBGHELP.DLL (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter Wtsapi32.dll (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter NSMTRACE (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\UpdatSupport1523\CryptPak.dll (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\UpdatSupport1523\HTCTL32.DLL (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003968) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\UpdatSupport1523\dbghelp.dll (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter Wtsapi32.dll (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter DBGHELP.DLL (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter NSMTRACE (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\UpdatSupport1523\CryptPak.dll (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\UpdatSupport1523\HTCTL32.DLL (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter WinInet.dll (UID: 00000000-00006980) "client32.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006980)37:T6745,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter GrooveChainGetGlobalInterfacePtrAddress (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "GetProcAddress" with a parameter GrooveChainCoCreateInstance (UID: 00000000-00003320) "client32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymGetLineFromAddr (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymGetLineFromName (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymGetLineNext (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymGetLinePrev (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymMatchFileName (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter StackWalk (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymCleanup (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymLoadModule (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymGetOptions (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymGetModuleInfo (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymGetSymFromAddr (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SymFunctionTableAccess (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter MiniDumpWriteDump (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsA (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_version (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_installed (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_netname (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_remotename (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_bridgename (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_networks (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_pingnet (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_open (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_close (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_findslaves (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_getsession (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_call (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_hangup (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_nsessions (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_connected (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_send (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_sendex (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_sendif (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_sendto (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_subset (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_pause (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_helpreq (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_maxpacket (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_openremote (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_closeremote (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_callremote (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_myaddr (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_loadbridge (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_getfailedreason (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_escape (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter ctl_publishservice (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003968) "client32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymGetLineFromAddr (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymGetLineFromName (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymGetLineNext (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymGetLinePrev (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymMatchFileName (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter StackWalk (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymCleanup (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymLoadModule (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymGetOptions (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymGetModuleInfo (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymGetSymFromAddr (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SymFunctionTableAccess (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter MiniDumpWriteDump (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsA (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_version (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_installed (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_netname (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_remotename (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_bridgename (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_networks (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_pingnet (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_open (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_close (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_findslaves (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_getsession (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_call (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_hangup (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_nsessions (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_connected (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_send (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_sendex (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_sendif (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_sendto (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_subset (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_pause (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_helpreq (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_maxpacket (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_openremote (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_closeremote (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_callremote (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_myaddr (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_loadbridge (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_getfailedreason (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_escape (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_publishservice (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_publishserviceex (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_findslavesex (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_broadcastdata (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_sendname (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_getlocalipaddressinuse (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_clientpinrequest (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_controlsendpin (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_controlpinrequest (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter ctl_clearpin (UID: 00000000-00006980) "client32.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006980)38:T6e7,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "remcmdstub.exe.3754310044") Found reference to API "ElevateCreateProcess ApplicationMonitor" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.00BA0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp, 00000000-00003320.00000000.77878.02F70000.00000004.mdmp, 00000000-00003320.00000000.77878.04B70000.00000004.mdmp, 00000000-00003320.00000000.77878.07800000.00000004.mdmp, 00000000-00003320.00000000.77878.07970000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "vateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.04B70000.00000004.mdmp") Found reference to API "evateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003320.00000000.77878.07800000.00000004.mdmp")39:T507,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp")3a:T781,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "GetLastError"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "ipleObjects error %d, GetLastError %d" (Indicator: "GetLastError"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "GetLastError"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "sv.GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp")3b:T789,"pcicapi.dll" contains export function called "CapiClose" at ordinal 1 "pcicapi.dll" contains export function called "CapiConnected" at ordinal 2 "pcicapi.dll" contains export function called "CapiDial" at ordinal 3 "pcicapi.dll" contains export function called "CapiHangup" at ordinal 4 "pcicapi.dll" contains export function called "CapiListen" at ordinal 5 "pcicapi.dll" contains export function called "CapiNotify" at ordinal 6 "pcicapi.dll" contains export function called "CapiOpen" at ordinal 7 "pcicapi.dll" contains export function called "CapiOpen2" at ordinal 8 "pcicapi.dll" contains export function called "CapiRead" at ordinal 9 "pcicapi.dll" contains export function called "CapiSend" at ordinal 10 "AudioCapture.dll" contains export function called "AddAudioCaptureEventListener" at ordinal 1 "AudioCapture.dll" contains export function called "DeviceChange" at ordinal 2 "AudioCapture.dll" contains export function called "Initialise" at ordinal 3 "AudioCapture.dll" contains export function called "IsCapturing" at ordinal 4 "AudioCapture.dll" contains export function called "RegisterWindow" at ordinal 5 "AudioCapture.dll" contains export function called "RemoveAudioCaptureEventListener" at ordinal 6 "AudioCapture.dll" contains export function called "StartCapturing" at ordinal 7 "AudioCapture.dll" contains export function called "StopCapturing" at ordinal 8 "AudioCapture.dll" contains export function called "UnInitialise" at ordinal 9 "PCICL32.DLL" contains export function called "_GetWMIStringW@16" at ordinal 1 "PCICL32.DLL" contains export function called "_IsAcerA@8" at ordinal 2 "PCICL32.DLL" contains export function called "_NSMClient32@8" at ordinal 3 "PCICL32.DLL" contains export function called "_NSMFindClass@12" at ordinal 4 "PCICL32.DLL" contains export function called "br_close" at ordinal 5 "PCICL32.DLL" contains export function called "br_open" at ordinal 63c:T7f4,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00003320.00000000.77878.00B35000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorun29.ini.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\autorun29.ini.lnk") in Source: 00000000-00003320.00000000.77878.00B35000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\autorun29.ini.lnk" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\autorun29.ini.lnk") in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\autorun29.ini.lnk" (Indicator: "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\autorun29.ini.lnk") in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp3d:T1f0e,"Software\WinRAR SFX" in Source: ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin "Software\Microsoft\Windows\CurrentVersion" in Source: ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin "Software\WinRAR SFX" in Source: 00000000-00003320.00000000.77878.00426000.00000002.mdmp 00000000-00003320.00000000.77878.06779000.00000004.mdmp 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003320.00000000.77878.00426000.00000002.mdmp 00000000-00003320.00000000.77878.06779000.00000004.mdmp 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutesegxz U`" in Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\" in Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoi" in Source: 00000000-00003320.00000000.77878.02C18000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "ISTRY\MACHINE\Software\WOW6432Node\M\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "RE\REGISTRY\MACHINE\Software\WOW6\R" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHI\REGISTRY\USER\S-1\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-120736726\Registry\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5\REGISTRY\REGISTRY\USER\S-1-5-21-735\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGIST\REGISTRY\USER\S-1-5-2\REGISTRY\USER\S-1-5-21-735\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-73514\REGISTRY\USER\S-1\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-73514\REGISTRY\\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-\REGISTRY\MA\REGISTRY\\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "Y\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "Software\Microsoft\Office\14.0\Common\Security" in Source: 00000000-00003320.00000000.77878.07A20000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\@" in Source: 00000000-00003320.00000000.77878.07C58000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00003320.00000000.77878.72461000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00003320.00000000.77878.72461000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00003320.00000000.77878.72461000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00003320.00000000.77878.72461000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp3e:T1eda,"Software\WinRAR SFX" in Source: 00000000-00003320.00000000.77878.00426000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003320.00000000.77878.00426000.00000002.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutesegxz U`" in Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\" in Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoi" in Source: 00000000-00003320.00000000.77878.02C18000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "ISTRY\MACHINE\Software\WOW6432Node\M\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "RE\REGISTRY\MACHINE\Software\WOW6\R" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHI\REGISTRY\USER\S-1\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-120736726\Registry\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5\REGISTRY\REGISTRY\USER\S-1-5-21-735\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGIST\REGISTRY\USER\S-1-5-2\REGISTRY\USER\S-1-5-21-735\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-73514\REGISTRY\USER\S-1\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-73514\REGISTRY\\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "\REGISTRY\USER\S-\REGISTRY\MA\REGISTRY\\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "Y\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003320.00000000.77878.04990000.00000004.mdmp "Software\WinRAR SFX" in Source: 00000000-00003320.00000000.77878.06779000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003320.00000000.77878.06779000.00000004.mdmp "Software\Microsoft\Office\14.0\Common\Security" in Source: 00000000-00003320.00000000.77878.07A20000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\@" in Source: 00000000-00003320.00000000.77878.07C58000.00000004.mdmp "Software\WinRAR SFX" in Source: 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00003320.00000000.77878.72461000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00003320.00000000.77878.72461000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00003320.00000000.77878.72461000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00003320.00000000.77878.72461000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003320.00000000.77878.7E490000.00000002.mdmp3f:T3efc,"03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "C:\03e0d9b601defd28ce944f96c8a0ad5b.exe" at 00400000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 2B750000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77650000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\System32\wow64.dll" at 57080000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 57000000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\System32\user32.dll" at 02C50000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 570E0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 749D0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 76EE0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\apphelp.dll" at 73FC0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\AcLayers.dll" at 71870000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 771C0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 77350000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 74B20000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 75300000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 774D0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 77280000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 75600000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 75B50000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 77300000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 75270000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 743C0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74070000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 74060000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75350000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 74090000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 753B0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 74C90000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 74AA0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 74980000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 74490000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 74370000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 77630000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 742D0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\setupapi.dll" at 75720000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\mpr.dll" at 73F70000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\winspool.drv" at 726D0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\IPHLPAPI.DLL" at 73F90000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 729D0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\sfc.dll" at 02BD0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\sfc_os.dll" at 73530000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 74170000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\comdlg32.dll" at 74690000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" at 72F20000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 770C0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72630000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 741A0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 73F10000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 725E0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 738E0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\riched32.dll" at 725D0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\riched20.dll" at 72550000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\usp10.dll" at 72530000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\msls31.dll" at 724F0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\msctf.dll" at 74B40000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 72EF0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\clbcatq.dll" at 740E0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll" at 72460000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\TextInputFramework.dll" at 72E70000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\CoreUIComponents.dll" at 72BA0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\CoreMessaging.dll" at 72DE0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\ntmarta.dll" at 73260000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\WinTypes.dll" at 72AD0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\cldapi.dll" at 72440000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\aepic.dll" at 72400000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\cryptsp.dll" at 723E0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\propsys.dll" at 733B0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\linkinfo.dll" at 723D0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\ntshrui.dll" at 72300000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\srvcli.dll" at 722E0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\cscapi.dll" at 729C0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL" at 71ED0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\msvcr90.dll" at 71E20000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\msvcp90.dll" at 71D90000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806\ATL90.dll" at 71D60000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\rsaenh.dll" at 71D30000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\OFFICE.ODF" at 07AE0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\Windows.StateRepositoryPS.dll" at 71CA0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\edputil.dll" at 71C60000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\urlmon.dll" at 716E0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\imagehlp.dll" at 75330000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\iertutil.dll" at 736A0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\msIso.dll" at 71C00000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\pcacli.dll" at 71BE0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SysWOW64\netutils.dll" at 729B0000 "client32.exe" loaded module "%APPDATA%\UpdatSupport1523\client32.exe" at 00BB0000 "client32.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 2B750000 "client32.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77650000 "client32.exe" loaded module "%WINDIR%\System32\wow64.dll" at 57080000 "client32.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 57000000 "client32.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 02FA0000 "client32.exe" loaded module "%WINDIR%\System32\user32.dll" at 03080000 "client32.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 570E0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 749D0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 76EE0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\apphelp.dll" at 73FC0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\AcLayers.dll" at 71870000 "client32.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 771C0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 77350000 "client32.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 74B20000 "client32.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 75300000 "client32.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 774D0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 77280000 "client32.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 75600000 "client32.exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 75B50000 "client32.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 77300000 "client32.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 75270000 "client32.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 743C0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 74060000 "client32.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74070000 "client32.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 74090000 "client32.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75350000 "client32.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 753B0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 74C90000 "client32.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 74AA0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 74980000 "client32.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 74490000 "client32.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 74370000 "client32.exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 77630000 "client32.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 742D0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\setupapi.dll" at 75720000 "client32.exe" loaded module "%WINDIR%\SysWOW64\mpr.dll" at 73F70000 "client32.exe" loaded module "%WINDIR%\SysWOW64\winspool.drv" at 726D0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\IPHLPAPI.DLL" at 73F90000 "client32.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 729D0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\sfc.dll" at 03090000 "client32.exe" loaded module "%WINDIR%\SysWOW64\sfc_os.dll" at 73530000 "client32.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 74170000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICL32.DLL" at 71F80000 "client32.exe" loaded module "%WINDIR%\SysWOW64\comdlg32.dll" at 74690000 "client32.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 770C0000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICHEK.DLL" at 725D0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\shfolder.dll" at 725C0000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\pcicapi.dll" at 10700000 "client32.exe" loaded module "%WINDIR%\SysWOW64\version.dll" at 73D90000 "client32.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" at 72530000 "client32.exe" loaded module "%WINDIR%\SysWOW64\winmm.dll" at 72500000 "client32.exe" loaded module "%WINDIR%\SysWOW64\wininet.dll" at 73AC0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\wsock32.dll" at 724F0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 741A0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\winmmbase.dll" at 724C0000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\msvcr100.dll" at 71EC0000 "client32.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72630000 "client32.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 73F10000 "client32.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 725E0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\dbghelp.dll" at 72330000 "client32.exe" loaded module "%WINDIR%\SysWOW64\wtsapi32.dll" at 72320000 "client32.exe" loaded module "%WINDIR%\SysWOW64\dbgcore.dll" at 722F0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 738E0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 72EF0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\devobj.dll" at 73960000 "client32.exe" loaded module "%WINDIR%\SysWOW64\wintrust.dll" at 76E90000 "client32.exe" loaded module "%WINDIR%\SysWOW64\msasn1.dll" at 75260000 "client32.exe" loaded module "%WINDIR%\SysWOW64\crypt32.dll" at 74500000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\HTCTL32.DLL" at 71E60000 "client32.exe" loaded module "%WINDIR%\SysWOW64\psapi.dll" at 74970000 "WerFault.exe" loaded module "%WINDIR%\SysWOW64\WerFault.exe" at 00F50000 "WerFault.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 2B750000 "WerFault.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77650000 "client32.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 00A70000 "client32.exe" loaded module "%WINDIR%\System32\user32.dll" at 02E10000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICL32.DLL" at 715B0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\shfolder.dll" at 71C40000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICHEK.DLL" at 71C30000 "client32.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 03220000 "client32.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" at 71520000 "client32.exe" loaded module "%WINDIR%\SysWOW64\winmm.dll" at 714F0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\wsock32.dll" at 71C20000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\msvcr100.dll" at 71430000 "client32.exe" loaded module "%WINDIR%\SysWOW64\winspool.drv" at 71300000 "client32.exe" loaded module "%WINDIR%\SysWOW64\winmmbase.dll" at 712D0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\winmmbase.dll" at 00B40000 "client32.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 71280000 "client32.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 71230000 "client32.exe" loaded module "%WINDIR%\SysWOW64\wtsapi32.dll" at 71420000 "client32.exe" loaded module "%WINDIR%\SysWOW64\dbghelp.dll" at 710A0000 "client32.exe" loaded module "%WINDIR%\SysWOW64\dbgcore.dll" at 71070000 "client32.exe" loaded module "\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\HTCTL32.DLL" at 7101000040:T15fc,"03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76ee0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76ee0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76ee0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "KERNEL32" at base 749d0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 725e0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738e0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "KERNEL32.DLL" at base 749d0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "RICHED32.DLL" at base 725d0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "RICHED20.DLL" at base 72550000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "COMCTL32.DLL" at base 72f20000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "COMCTL32" at base 72f20000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75b50000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72460000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "RPCRT4.DLL" at base 743c0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "OLEAUT32.DLL" at base 742d0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 77350000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 77350000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 753b0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74b40000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 770c0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "NTDLL.DLL" at base 77650000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 733b0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74c90000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74c90000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "CSCAPI.DLL" at base 729c0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "SHELL32.DLL" at base 75b50000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%PROGRAMFILES(X86)%\MICROS~1\OFFICE14\GROOVEEX.DLL" at base 71ed0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71d30000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%PROGRAMFILES(X86)%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 7ae0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 71ca0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75b50000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 749d0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "USER32.DLL" at base 77350000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 716e0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "MSISO.DLL" at base 71c00000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "SSPICLI.DLL" at base 74070000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76ee0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73fc0000 "03e0d9b601defd28ce944f96c8a0ad5b.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 73530000 "client32.exe" loaded module "%APPDATA%\UPDATSUPPORT1523\DBGHELP.DLL" at base 0 "client32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76ee0000 "client32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76ee0000 "client32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76ee0000 "client32.exe" loaded module "KERNEL32" at base 749d0000 "client32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 725e0000 "client32.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 749d0000 "client32.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 76ee0000 "client32.exe" loaded module "DBGHELP.DLL" at base 72330000 "client32.exe" loaded module "WTSAPI32.DLL" at base 72320000 "client32.exe" loaded module "ADVAPI32.DLL" at base 74aa0000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738e0000 "client32.exe" loaded module "NSMTRACE" at base 0 "client32.exe" loaded module "KERNEL32.DLL" at base 749d0000 "client32.exe" loaded module "SETUPAPI.DLL" at base 75720000 "client32.exe" loaded module "%APPDATA%\UPDATSUPPORT1523\CRYPTPAK.DLL" at base 0 "client32.exe" loaded module "%APPDATA%\UPDATSUPPORT1523\HTCTL32.DLL" at base 71e60000 "client32.exe" loaded module "PSAPI.DLL" at base 74970000 "client32.exe" loaded module "NTDLL.DLL" at base 77650000 "client32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71230000 "client32.exe" loaded module "WTSAPI32.DLL" at base 71420000 "client32.exe" loaded module "DBGHELP.DLL" at base 710a0000 "client32.exe" loaded module "%APPDATA%\UPDATSUPPORT1523\HTCTL32.DLL" at base 71010000 "client32.exe" loaded module "WININET.DLL" at base 73ac000041:Td60,"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin" was detected as "WinRAR" and name: "sfx" "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin" was detected as "Microsoft Linker" and name: "Linker" "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin" was detected as "RAR" and name: "Archive" "client32.exe" was detected as "WinRAR" and name: "sfx" "client32.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "client32.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "client32.exe" was detected as "Microsoft Linker" and name: "Linker" "client32.exe" was detected as "RAR" and name: "Archive" "pcicapi.dll" was detected as "WinRAR" and name: "sfx" "pcicapi.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "pcicapi.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pcicapi.dll" was detected as "Microsoft Linker" and name: "Linker" "pcicapi.dll" was detected as "RAR" and name: "Archive" "AudioCapture.dll" was detected as "WinRAR" and name: "sfx" "AudioCapture.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AudioCapture.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AudioCapture.dll" was detected as "Microsoft Linker" and name: "Linker" "AudioCapture.dll" was detected as "RAR" and name: "Archive" "remcmdstub.exe" was detected as "WinRAR" and name: "sfx" "remcmdstub.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "remcmdstub.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "remcmdstub.exe" was detected as "Microsoft Linker" and name: "Linker" "remcmdstub.exe" was detected as "RAR" and name: "Archive" "PCICL32.DLL" was detected as "WinRAR" and name: "sfx" "PCICL32.DLL" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PCICL32.DLL" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PCICL32.DLL" was detected as "Microsoft Linker" and name: "Linker" "PCICL32.DLL" was detected as "RAR" and name: "Archive" "TCCTL32.DLL" was detected as "WinRAR" and name: "sfx" "TCCTL32.DLL" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "TCCTL32.DLL" was detected as "Microsoft Visual C/C++" and name: "Compiler" "TCCTL32.DLL" was detected as "Microsoft Linker" and name: "Linker" "TCCTL32.DLL" was detected as "RAR" and name: "Archive" "HTCTL32.DLL" was detected as "WinRAR" and name: "sfx" "HTCTL32.DLL" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "HTCTL32.DLL" was detected as "Microsoft Visual C/C++" and name: "Compiler" "HTCTL32.DLL" was detected as "Microsoft Linker" and name: "Linker" "HTCTL32.DLL" was detected as "RAR" and name: "Archive" "PCICHEK.DLL" was detected as "WinRAR" and name: "sfx" "PCICHEK.DLL" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PCICHEK.DLL" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PCICHEK.DLL" was detected as "Microsoft Linker" and name: "Linker" "PCICHEK.DLL" was detected as "RAR" and name: "Archive"42:T13b9,"03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Previous Versions Property Page" (Path: "HKCU\WOW6432NODE\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Microsoft SendTo Service" (Path: "HKCU\WOW6432NODE\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Copy as Path Menu" (Path: "HKCU\WOW6432NODE\CLSID\{F3D06E7C-1E45-4A26-847E-F9FCDEE59BE0}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Start Menu Pin" (Path: "HKCU\WOW6432NODE\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Taskband Pin" (Path: "HKCU\WOW6432NODE\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Groove GFS Context Menu Handler" (Path: "HKCU\WOW6432NODE\CLSID\{6C467336-8281-4E60-8204-430CED96822D}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Open With Context Menu Handler" (Path: "HKCU\WOW6432NODE\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Ribbon Modern Share Verb" (Path: "HKCU\WOW6432NODE\CLSID\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Pin To Start Screen verb handler" (Path: "HKCU\WOW6432NODE\CLSID\{470C0EBD-5D73-4D58-9CED-E91E22E23282}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "CompatContextMenu Class" (Path: "HKCU\WOW6432NODE\CLSID\{1D27F844-3A1F-4410-85AC-14651078412D}\SHELLEX\MAYCHANGEDEFAULTMENU") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "File Property Page Extension" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}\INPROCSERVER32") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS")43:T17cb,"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin" file has an entrypoint instructions - "call 0x422575,jmp 0x41cb5a,mov edi, edi,push ebp,mov ebp, esp,push esi,lea eax, [ebp + 8],push eax,mov esi, ecx,call 0x41f128,mov dword ptr [esi], 0x4271d4,mov eax, esi,pop esi,pop ebp,ret 4,mov dword ptr [ecx], 0x4271d4,jmp 0x41f1f5,mov edi, edi,push ebp,mov ebp, esp,push esi,mov esi, ecx,mov dword ptr [esi], 0x4271d4,call 0x41f1f5,test byte ptr [ebp + 8], 1,je 0x41cd2b,push esi,call 0x419aea,pop ecx,mov eax, esi,pop esi,pop ebp,ret 4,mov edi, edi,push ebp,mov ebp, esp,push esi,push edi,mov edi, dword ptr [ebp + 8]," "client32.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x44,push esi,call dword ptr [0x402000],mov esi, eax,mov al, byte ptr [esi],cmp al, 0x22,jne 0x401054,mov al, byte ptr [esi + 1],inc esi,test al, al,je 0x40104c,lea ecx, [ecx],cmp al, 0x22,je 0x401051,mov al, byte ptr [esi + 1],inc esi,test al, al,jne 0x401040,cmp byte ptr [esi], 0x22,jne 0x40105e,inc esi,jmp 0x40105e,cmp al, 0x20,jbe 0x40105e,inc esi,cmp byte ptr [esi], 0x20,ja 0x401058,mov al, byte ptr [esi],test al, al,je 0x401070,cmp al, 0x20,ja 0x401070,mov al, byte ptr [esi + 1],inc esi,test al, al,jne 0x401064,lea eax, [ebp - 0x44],push eax,mov dword ptr [ebp - 0x18], 0,call dword ptr [0x40200c]," "pcicapi.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x10705cf9,cmp dword ptr [0x10715bd8], 0,jmp 0x10705d1f,cmp esi, 1,je 0x10705d03,cmp esi, 2,jne 0x10705d25,mov eax, dword ptr [0x10723e78],test eax, eax,je 0x10705d15,push edi,push esi,push ebx,call eax,test eax, eax,je 0x10705d21,push edi,push esi,push ebx,call 0x10705c04,test eax, eax,jne 0x10705d25,xor eax, eax,jmp 0x10705d73,push edi,push esi,push ebx,call 0x10702c20,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x10705d41,test eax, eax,jne 0x10705d70,push edi,push eax,push ebx,call 0x10705c04," "AudioCapture.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x12305392,call 0x12307b79,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1230528c,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x1230f220,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x123053da,test byte ptr [eax], 8,je 0x123053da,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c]," "remcmdstub.exe" file has an entrypoint instructions - "call 0x405973,jmp 0x402053,sub eax, 0x3a4,je 0x4021e7,sub eax, 4,je 0x4021e1,sub eax, 0xd,je 0x4021db,dec eax,je 0x4021d5,xor eax, eax,ret ,mov eax, 0x404,ret ,mov eax, 0x412,ret ,mov eax, 0x804,ret ,mov eax, 0x411,ret ,mov edi, edi,push esi,push edi,mov esi, eax,push 0x101,xor edi, edi,lea eax, [esi + 0x1c],push edi,push eax,call 0x401fb0,xor eax, eax,movzx ecx, ax,mov eax, ecx,mov dword ptr [esi + 4], edi,mov dword ptr [esi + 8], edi,mov dword ptr [esi + 0xc], edi,shl ecx, 0x10," "PCICL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x111550dd,call 0x11162857,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x11154fd7,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x10,mov eax, dword ptr [0x111d32c4],xor eax, ebp,mov dword ptr [ebp - 4], eax,mov edx, dword ptr [ebp + 0x18],push ebx,xor ebx, ebx,push esi,push edi,cmp edx, ebx,jle 0x1115512d,mov eax, dword ptr [ebp + 0x14],mov ecx, edx,dec ecx,cmp byte ptr [eax], bl,je 0x11155120,inc eax,cmp ecx, ebx,jne 0x11155113,or ecx, 0xffffffff,mov eax, edx,sub eax, ecx,dec eax,cmp eax, edx,jge 0x1115512a,inc eax,mov dword ptr [ebp + 0x18], eax,mov dword ptr [ebp - 8], ebx," "TCCTL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x101794e7,call 0x10182e0e,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x101793e1,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x101a7eb0], eax,mov dword ptr [0x101a7eac], ecx,mov dword ptr [0x101a7ea8], edx,mov dword ptr [0x101a7ea4], ebx,mov dword ptr [0x101a7ea0], esi,mov dword ptr [0x101a7e9c], edi,mov word ptr [0x101a7ec8], ss,mov word ptr [0x101a7ebc], cs," "HTCTL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x101d3126,call 0x101dc8bd,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x101d3020,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push 0x101f0158,call dword ptr [0x101ed1a8],test eax, eax,je 0x101d3162,push 0x101f0148,push eax,call dword ptr [0x101ed074],test eax, eax,je 0x101d3162,push dword ptr [ebp + 8],call eax,pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x101d3139,pop ecx,push dword ptr [ebp + 8]," "PCICHEK.DLL" file has an entrypoint instructions - "push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 0xc],dec eax,mov ecx, dword ptr [ebp + 8],mov dword ptr [0x10183488], ecx,jne 0x101810b9,push ecx,call dword ptr [0x10182008],mov eax, 1,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,sub esp, 0x5c,mov eax, dword ptr [0x10183000],xor eax, ebp,mov dword ptr [ebp - 4], eax,mov eax, dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x14],push esi,mov esi, dword ptr [ebp + 0x10],push edi,mov dword ptr [ebp - 0x5c], eax,mov dword ptr [ebp - 0x58], ecx,test esi, esi,je 0x101811a2,cmp byte ptr [esi], 0x30,jge 0x10181106,mov edi, edi,inc esi,cmp byte ptr [esi], 0x30,"44:T53c,Process "client32.exe" (UID: 00000000-00003968) was launched with new environment variables: "sfxcmd=""C:\03e0d9b601defd28ce944f96c8a0ad5b.exe"", __COMPAT_LAYER="ElevateCreateProcess", sfxname="C:\03e0d9b601defd28ce944f96c8a0ad5b.exe", PROCESSOR_ARCHITEW6432="AMD64"" Process "client32.exe" (UID: 00000000-00003968) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00006456) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00006456) was launched with missing environment variables: "sfxcmd, __COMPAT_LAYER, sfxname, PROCESSOR_ARCHITEW6432" Process "client32.exe" (UID: 00000000-00006980) was launched with new environment variables: "PROMPT="$P$G", PROCESSOR_ARCHITEW6432="AMD64"" Process "client32.exe" (UID: 00000000-00006980) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00006852) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00006852) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432"45:Tddc,Observed system executable string:"C:\windows\temp\VxSSL32.dll" [Source: 00000000-00003320.00000000.77878.00A10000.00000020.mdmp 00000000-00003320.00000000.77878.02F60000.00000002.mdmp] Observed system executable string:"\??\C:\WINDOWS\SysWOW64\msiso.dll" [Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp] Observed system executable string:"32\msi\??\C:\WINDOWS\SYSTEM32\msiso.dll" [Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\ntdll.dll" [Source: 00000000-00003320.00000000.77878.00A77000.00000004.mdmp] Observed system executable string:"\??\C:\WINDOWS\SYSTEM32\msiso.dll" [Source: 00000000-00003320.00000000.77878.00B35000.00000004.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoa.dll" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\sxsoa.dll" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\GdiPlus.dll" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\GdiPlus.dll" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\comctl32.dll" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoaps.dll" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\sxsoaps.dll" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll.mui" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\comctl32.dll.mui" [Source: 00000000-00003320.00000000.77878.00B80000.00000002.mdmp] Observed system executable string:"C:\windows\temp\VxOle32.dll" [Source: 00000000-00003320.00000000.77878.02C20000.00000020.mdmp 00000000-00003320.00000000.77878.04980000.00000002.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\ntdll.dll" [Source: 00000000-00003320.00000000.77878.02C40000.00000004.mdmp 00000000-00003320.00000000.77878.02C90000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64cpu.dll" [Source: 00000000-00003320.00000000.77878.02C40000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64.dll" [Source: 00000000-00003320.00000000.77878.02C40000.00000004.mdmp] Observed system executable string:"C:\WINDOWS\system32\wow64cpu.dll" [Source: 00000000-00003320.00000000.77878.02C40000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64win.dll" [Source: 00000000-00003320.00000000.77878.02C40000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\apphelp.dll" [Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNEL32.DLL" [Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNELBASE.dll" [Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\USER32.dll" [Source: 00000000-00003320.00000000.77878.02C90000.00000004.mdmp]46:T4c5,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")47:Tb10,"client32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\client32.exe]- [targetUID: 00000000-00003968] "pcicapi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\pcicapi.dll]- [targetUID: 00000000-00003968] "AudioCapture.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\AudioCapture.dll]- [targetUID: 00000000-00003320] "remcmdstub.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\remcmdstub.exe]- [targetUID: 00000000-00003320] "autorun29.ini.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Hidden Archive ctime=Tue May 23 10:09:03 2023 mtime=Tue May 23 10:09:03 2023 atime=Fri Oct 4 19:04:26 2013 length=103824 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\autorun29.ini.lnk]- [targetUID: 00000000-00003320] "nskbfltr.inf" has type "Windows setup INFormation"- Location: [%APPDATA%\UpdatSupport1523\nskbfltr.inf]- [targetUID: 00000000-00003320] "PCICL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\PCICL32.DLL]- [targetUID: 00000000-00003968] "TCCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\TCCTL32.DLL]- [targetUID: 00000000-00003320] "HTCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\HTCTL32.DLL]- [targetUID: 00000000-00003968] "PCICHEK.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\PCICHEK.DLL]- [targetUID: 00000000-00003968] "NSM.ini" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%APPDATA%\UpdatSupport1523\NSM.ini]- [targetUID: 00000000-00003320] "client32.ini" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\UpdatSupport1523\client32.ini]- [targetUID: 00000000-00003968] "NSM.LIC" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\UpdatSupport1523\NSM.LIC]- [targetUID: 00000000-00003968] "nsm_vpro.ini" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\UpdatSupport1523\nsm_vpro.ini]- [targetUID: 00000000-00003320] "autorun29.ini.lnk.bin" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Hidden Archive ctime=Tue May 23 10:09:03 2023 mtime=Tue May 23 10:09:03 2023 atime=Fri Oct 4 19:04:26 2013 length=103824 window=hide"- [targetUID: N/A]48:T7df,"03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\03e0d9b601defd28ce944f96c8a0ad5b.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\windows\win.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\windows\fonts\staticcache.dat" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\music\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\links\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "c:\users\%osuser%\saved games\desktop.ini" "client32.exe" reads file "c:\users\%osuser%\appdata\roaming\updatsupport1523\nsm.lic" "client32.exe" reads file "c:\users\%osuser%\appdata\roaming\updatsupport1523\client32.ini"49:Tdc67,"03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\03e0d9b601defd28ce944f96c8a0ad5b.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\winspool.drv" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\IPHLPAPI.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\bcrypt.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\sfc_os.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\cfgmgr32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\bcryptprimitives.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\cryptbase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\sspicli.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\rpcrt4.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\combase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\SHCore.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\advapi32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\shlwapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\kernel.appcore.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\powrprof.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\profapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\windows.storage.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\shell32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\setupapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\ole32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\03E0D9B601DEFD28CE944F96C8A0AD5B.EXE.LOCAL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\comdlg32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\FLTLIB.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\ws2_32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\RPCSS.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\RICHED32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\riched32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\riched32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\riched32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\RICHED20.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\RICHED20.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\riched20.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\RICHED20.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\USP10.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\USP10.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\usp10.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\USP10.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\MSLS31.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\msls31.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\msls31.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\msls31.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\msctf.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\dwmapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\system32\dwmapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\03e0d9b601defd28ce944f96c8a0ad5b.exe.Local\" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\win.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\clbcatq.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\Registration\R00000000000d.clb" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\Fonts\StaticCache.dat" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\TextInputFramework.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\System32\TextInputFramework.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\CoreUIComponents.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\System32\CoreUIComponents.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\CoreMessaging.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\System32\CoreMessaging.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\ntmarta.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ntmarta.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\WinTypes.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\wintypes.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\user32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\__tmp_rar_sfx_access_check_21213468" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\UpdatSupport1523" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UPDATSUPPORT1523" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UPDATSUPPORT1523\AUDIOCAPTURE.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\AudioCapture.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\UpdatSupport1523\AudioCapture.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CLIENT32.EXE" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CLIENT32.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\HTCTL32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\MSVCR100.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\msvcr100.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSKBFLTR.INF" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\nskbfltr.inf" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM.LIC" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM_VPRO.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\nsm_vpro.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICAPI.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\pcicapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICHEK.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICL32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\REMCMDSTUB.EXE" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\remcmdstub.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\TCCTL32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\cldapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CLDAPI.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\aepic.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\AEPIC.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\share" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\cryptsp.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\cryptsp.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\propsys.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\system32\propsys.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002d.db" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Desktop\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Documents\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Music\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Pictures\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Videos\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Downloads\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Searches\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Contacts\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Favorites\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Links\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\linkinfo.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\LINKINFO.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\ntshrui.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ntshrui.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\srvcli.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\srvcli.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "\Device\NamedPipe\srvsvc" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\CSCAPI.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\cscapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\cscapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\cscapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AUTORUN29.INI.LNK" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorun29.ini.lnk" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SysWOW64\propsys.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\System32\propsys.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\en-US\propsys.dll.mui" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\en-US\shell32.dll.mui" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\msvcr90.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\MSVCR90.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\msvcp90.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\MSVCP90.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806\ATL90.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806\ATL90.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\rsaenh.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\system32\rsaenh.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\Windows.StateRepositoryPS.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\System32\Windows.StateRepositoryPS.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\en-US\windows.storage.dll.mui" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\edputil.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\edputil.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\urlmon.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\urlmon.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\iertutil.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\iertutil.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\imagehlp.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\msIso.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\msiso.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.exe:ZONE.IDENTIFIER" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.exe:Zone.Identifier" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\pcacli.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\pcacli.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_ROAMING_UPDATSUPPORT1523_65A9D90AE592DE82.CDF-MS" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\Windows\SysWOW64\netutils.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "C:\WINDOWS\SYSTEM32\netutils.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\WindowsShell.Manifest" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\usp10.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\msls31.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\riched20.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\riched32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\msctf.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\en-US\user32.dll.mui" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\UXTHEME.DLL.CONFIG" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\win.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\clbcatq.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\Registration\R00000000000d.clb" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%PROGRAMFILES%\(x86)\Common Files\microsoft shared\ink\tiptsf.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\Fonts\StaticCache.dat" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\ntmarta.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\CoreMessaging.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\WinTypes.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\CoreUIComponents.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\TextInputFramework.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\__tmp_rar_sfx_access_check_21213468" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UPDATSUPPORT1523" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UPDATSUPPORT1523\AUDIOCAPTURE.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\AudioCapture.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\CLIENT32.EXE" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\CLIENT32.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\MSVCR100.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\NSKBFLTR.INF" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\nskbfltr.inf" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\NSM.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\NSM.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\NSM_VPRO.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\nsm_vpro.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\PCICAPI.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\REMCMDSTUB.EXE" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\remcmdstub.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\TCCTL32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\cryptsp.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\aepic.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\cldapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002d.db" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\DESKTOP.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Desktop\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Documents\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Music\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Pictures\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Videos\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Downloads\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\OneDrive\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\AppData" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\AppData\Roaming" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows\Start Menu" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows\Start Menu\Programs" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Searches\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Contacts\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Favorites\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Links\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%USERPROFILE%\Saved Games\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\linkinfo.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\ntshrui.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\srvcli.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\cscapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\AUTORUN29.INI.LNK" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\autorun29.ini.lnk" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\propsys.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\System32\propsys.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\en-US\propsys.dll.mui" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\en-US\shell32.dll.mui" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\msvcp90.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806\ATL90.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%PROGRAMFILES%\(x86)\Microsoft Office\Office14\GROOVEEX.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\msvcr90.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\rsaenh.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%PROGRAMFILES%\(x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\RPCSS.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\Windows.StateRepositoryPS.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\en-US\windows.storage.dll.mui" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\edputil.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\iertutil.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\imagehlp.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\urlmon.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\msIso.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\client32.exe:ZONE.IDENTIFIER" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\pcacli.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_ROAMING_UPDATSUPPORT1523_65A9D90AE592DE82.CDF-MS" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\ntdll.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\kernel32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\apppatch\sysmain.sdb" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\AcLayers.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\apphelp.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\msvcrt.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\win32u.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\ucrtbase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\msvcp_win.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32full.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\user32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\cfgmgr32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\bcryptprimitives.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\cryptbase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\sechost.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\sspicli.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\rpcrt4.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\combase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\SHCore.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\advapi32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\shlwapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\kernel.appcore.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\powrprof.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\profapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\windows.storage.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\shell32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\setupapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\sfc.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\sfc_os.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\netutils.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\ws2_32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\comdlg32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\System32\WOW64LOG.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\PCICL32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\PCICHEK.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\pcicapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\msvcr100.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\mpr.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\winspool.drv" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\IPHLPAPI.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\IPHLPAPI.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\bcrypt.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\imm32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\oleaut32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\ole32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\Temp\VxSSL32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\FLTLIB.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\fltLib.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\Temp\VxOle32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\uxtheme.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\dwmapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\SysWOW64\KernelBase.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\client32.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\NSM.LIC" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\client32.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to touch file "%APPDATA%\UpdatSupport1523\HTCTL32.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.exe" "client32.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "client32.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "client32.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\winspool.drv" "client32.exe" trying to touch file "C:\Windows\SysWOW64\IPHLPAPI.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\bcrypt.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\sfc_os.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\cfgmgr32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\bcryptprimitives.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\cryptbase.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\sspicli.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\rpcrt4.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\combase.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\SHCore.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\advapi32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\shlwapi.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\kernel.appcore.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\powrprof.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\profapi.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\windows.storage.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\shell32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\setupapi.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\ole32.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICL32.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CLIENT32.EXE.LOCAL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\SHFOLDER.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\shfolder.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICHEK.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\pcicapi.dll" "client32.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\VERSION.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WINMM.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\winmm.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WSOCK32.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\wsock32.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WININET.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\wininet.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\msvcr100.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WINMMBASE.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\winmmbase.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\ws2_32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\comdlg32.dll" "client32.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\FLTLIB.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\DBGHELP.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\dbghelp.dll" "client32.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "client32.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "client32.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\dbghelp.dll" "client32.exe" trying to touch file "C:\WINDOWS\SYSTEM32\DBGHELP.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WTSAPI32.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\Wtsapi32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\wtsapi32.dll" "client32.exe" trying to touch file "C:\WINDOWS\SYSTEM32\Wtsapi32.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\DBGCORE.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\dbgcore.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\dbgcore.dll" "client32.exe" trying to touch file "C:\WINDOWS\SYSTEM32\dbgcore.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "client32.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\dwmapi.dll" "client32.exe" trying to touch file "C:\WINDOWS\system32\dwmapi.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM.LIC" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PRODUCT.DAT" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.ini" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\ProgramData\Oracle\Java\javapath\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\ProgramData\Oracle\Java\javapath_target_114250\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\WINDOWS\system32\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Windows\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\WINDOWS\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\wbem\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\WINDOWS\System32\Wbem\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Program Files (x86)\WIRESHARK\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Program Files (x86)\Wireshark\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Program Files\Wireshark\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Program Files\mitmproxy\bin\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "client32.exe" trying to touch file "C:\Windows\SysWOW64\devobj.dll" "client32.exe" trying to touch file "C:\WINDOWS\SYSTEM32\DEVOBJ.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\msasn1.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\crypt32.dll" "client32.exe" trying to touch file "C:\Windows\SysWOW64\wintrust.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM32.CHM" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CRYPTPAK.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CryptPak.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\HTCTL32.DLL" "client32.exe" trying to touch file "C:\Windows\SysWOW64\psapi.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\SUPPORT\CLIENT32.1_2023_05_23_030908.DMP" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.1_2023_05_23_030908.dmp" "client32.exe" trying to touch file "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "client32.exe" trying to touch file "C:\FLTLIB.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\ntdll.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\kernel32.dll" "client32.exe" trying to touch file "%WINDIR%\apppatch\sysmain.sdb" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\AcLayers.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\apphelp.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\msvcrt.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\win32u.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\ucrtbase.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\msvcp_win.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32full.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\user32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\cfgmgr32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\bcryptprimitives.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\cryptbase.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\sechost.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\sspicli.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\rpcrt4.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\combase.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\SHCore.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\advapi32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\shlwapi.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\kernel.appcore.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\powrprof.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\profapi.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\windows.storage.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\shell32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\setupapi.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\sfc.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\sfc_os.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\ws2_32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\comdlg32.dll" "client32.exe" trying to touch file "%APPDATA%\NSMTRACE.DLL" "client32.exe" trying to touch file "%PROGRAMFILES%\(x86)\WIRESHARK\NSMTRACE.DLL" "client32.exe" trying to touch file "%PROGRAMFILES%\Wireshark\NSMTRACE.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\msasn1.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\crypt32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\wintrust.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\psapi.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\SUPPORT\CLIENT32.1_2023_05_23_030908.DMP" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\client32.1_2023_05_23_030908.dmp" "client32.exe" trying to touch file "%WINDIR%\System32\WOW64LOG.DLL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\PCICL32.DLL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\CLIENT32.EXE.LOCAL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\SHFOLDER.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\shfolder.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\PCICHEK.DLL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\pcicapi.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\VERSION.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\version.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\WINMM.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\winmm.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\WSOCK32.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\wsock32.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\msvcr100.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\mpr.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\winspool.drv" "client32.exe" trying to touch file "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\WININET.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\wininet.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\WINMMBASE.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\winmmbase.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\IPHLPAPI.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\IPHLPAPI.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\bcrypt.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\imm32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\oleaut32.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\ole32.dll" "client32.exe" trying to touch file "%WINDIR%\Temp\VxSSL32.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\FLTLIB.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\fltLib.dll" "client32.exe" trying to touch file "%WINDIR%\Temp\VxOle32.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\WTSAPI32.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\wtsapi32.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\DBGHELP.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\dbghelp.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\DBGCORE.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\dbgcore.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\uxtheme.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\dwmapi.dll" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\KernelBase.dll" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\PRODUCT.DAT" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\client32.ini" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\NSM.LIC" "client32.exe" trying to touch file "%WINDIR%\System\NSMTRACE.DLL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\NSMTRACE.DLL" "client32.exe" trying to touch file "%ALLUSERSPROFILE%\Oracle\Java\javapath\NSMTRACE.DLL" "client32.exe" trying to touch file "%ALLUSERSPROFILE%\Oracle\Java\javapath_target_114250\NSMTRACE.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\NSMTRACE.DLL" "client32.exe" trying to touch file "%WINDIR%\NSMTRACE.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\wbem\NSMTRACE.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\NSMTRACE.DLL" "client32.exe" trying to touch file "%LOCALAPPDATA%\Microsoft\WindowsApps\NSMTRACE.DLL" "client32.exe" trying to touch file "%PROGRAMFILES%\mitmproxy\bin\NSMTRACE.DLL" "client32.exe" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\client32.exe" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\NSM32.CHM" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\CRYPTPAK.DLL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\HTCTL32.DLL" "client32.exe" trying to touch file "%WINDIR%\SysWOW64\devobj.dll" "client32.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\MPR.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WINSPOOL.DRV" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\IPHLPAPI.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\BCRYPT.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\WINDOWS\SYSTEM32\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Windows\System\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\WINDOWS\system\NSMTRACE.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\DEVOBJ.DLL" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\DEVOBJ.dll" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\SUPPORT\CLIENT32.1_2023_05_23_030936.DMP" "client32.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.1_2023_05_23_030936.dmp" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\MPR.DLL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\WINSPOOL.DRV" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\BCRYPT.DLL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\DEVOBJ.DLL" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\SUPPORT\CLIENT32.1_2023_05_23_030936.DMP" "client32.exe" trying to touch file "%APPDATA%\UpdatSupport1523\client32.1_2023_05_23_030936.dmp"4a:T497,"03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorun29.ini.lnk" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" "03e0d9b601defd28ce944f96c8a0ad5b.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\autorun29.ini.lnk"4b:T1c59,"03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Windows\SysWOW64\apphelp.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\FLTLIB.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\RICHED32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\riched32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\RICHED20.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\RICHED20.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\USP10.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\USP10.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\MSLS31.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\msls31.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CLIENT32.EXE" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\HTCTL32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\MSVCR100.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\msvcr100.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICAPI.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\pcicapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICHEK.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICL32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\REMCMDSTUB.EXE" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\remcmdstub.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\TCCTL32.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\CSCAPI.DLL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\cscapi.dll" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\SHFOLDER.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\VERSION.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WINMM.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WSOCK32.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WININET.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WINMMBASE.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\FLTLIB.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\DBGHELP.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\dbghelp.dll" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WTSAPI32.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\Wtsapi32.dll" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\DBGCORE.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\dbgcore.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Windows\SysWOW64\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\WINDOWS\system32\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Windows\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\WINDOWS\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Program Files\Wireshark\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Program Files\mitmproxy\bin\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CRYPTPAK.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CryptPak.dll" "client32.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\MPR.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\IPHLPAPI.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\BCRYPT.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Windows\System\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\WINDOWS\system\NSMTRACE.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\DEVOBJ.DLL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\DEVOBJ.dll"4c:Tcd3,"03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\03E0D9B601DEFD28CE944F96C8A0AD5B.EXE.LOCAL" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\03e0d9b601defd28ce944f96c8a0ad5b.exe.Local\" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\UpdatSupport1523" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UPDATSUPPORT1523" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CLIENT32.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSKBFLTR.INF" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\nskbfltr.inf" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM.LIC" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM_VPRO.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\nsm_vpro.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AUTORUN29.INI.LNK" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorun29.ini.lnk" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.exe:ZONE.IDENTIFIER" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.exe:Zone.Identifier" "03e0d9b601defd28ce944f96c8a0ad5b.exe" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_ROAMING_UPDATSUPPORT1523_65A9D90AE592DE82.CDF-MS" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\CLIENT32.EXE.LOCAL" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PRODUCT.DAT" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\NSM32.CHM" "client32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\WINSPOOL.DRV"4d:Tbe5,"03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\audiocapture.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\client32.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\client32.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\htctl32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\msvcr100.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\nskbfltr.inf" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\nsm.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\nsm.lic" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\nsm_vpro.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\pcicapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\pcichek.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\pcicl32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\remcmdstub.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\updatsupport1523\tcctl32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "\device\namedpipe\srvsvc" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\autorun29.ini.lnk" "client32.exe" writes file "%appdata%\updatsupport1523\client32.exe" "client32.exe" writes file "%appdata%\updatsupport1523\pcicapi.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "%appdata%\updatsupport1523\audiocapture.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "%appdata%\updatsupport1523\remcmdstub.exe" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "%appdata%\microsoft\windows\start menu\programs\startup\autorun29.ini.lnk" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "%appdata%\updatsupport1523\nskbfltr.inf" "client32.exe" writes file "%appdata%\updatsupport1523\pcicl32.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "%appdata%\updatsupport1523\tcctl32.dll" "client32.exe" writes file "%appdata%\updatsupport1523\htctl32.dll" "client32.exe" writes file "%appdata%\updatsupport1523\pcichek.dll" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "%appdata%\updatsupport1523\nsm.ini" "client32.exe" writes file "%appdata%\updatsupport1523\client32.ini" "client32.exe" writes file "%appdata%\updatsupport1523\nsm.lic" "03e0d9b601defd28ce944f96c8a0ad5b.exe" writes file "%appdata%\updatsupport1523\nsm_vpro.ini"4e:T6b0,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "[=0'.in" Heuristic match: "QGp.cc" Heuristic match: "K>.mL" Heuristic match: "wK2_.ma" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/ThawteTimestampingCA.crl0TimeStamp-2048-10y@b%Symantec" Pattern match: "SPj-SPj.SPj/SPj0SPjDSPjESPjFSPjGSPjHSPjISPjJSPjKSPjLSPjMSPjNSPjOSjPj8SPj9SPj:SPj;SPj" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "ystem.ActivityHistory.Id" Heuristic match: "ystem.AppUserModel.ID" Heuristic match: "ystem.IdentityProvider.Name" Heuristic match: "ystem.Protocol.Name" Heuristic match: "ystem.SAM.Name" Heuristic match: "ystem.StructuredQuery.Is" Heuristic match: "ystem.StructuredQuery.Virtual.Cc" Heuristic match: "ystem.StructuredQuery.Virtual.To" Heuristic match: "System.ActivityHistory.Id" Heuristic match: "System.IdentityProvider.Name" Heuristic match: "System.SAM.Name" Heuristic match: "System.StructuredQuery.Virtual.Cc" Heuristic match: "System.StructuredQuery.Virtual.To" Heuristic match: "System.StructuredQuery.Is" Heuristic match: "System.Protocol.Name" Heuristic match: "System.AppUserModel.ID" Heuristic match: "System.StructuredQueryType.Implicit.Is" Heuristic match: "r->hdr.id == req->hdr.id" Heuristic match: "1Uk .Uk" Heuristic match: "hHr@iHr0.Gr" Heuristic match: ".Frh.Fr0.Fr" Heuristic match: "Sets or retrieves which panel is currently active in the pen input panel.WF" Heuristic match: "Specifies the stroke or collection of strokes to remove from the given collection of strokes.WS" Heuristic match: "Provides the best tradeoff between save-time and storage for the typical application.WS"4f:T8e0,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\windows\\temp\\VxOle32.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernelbase.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\rpcss.dll" "$status": "c0000034"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\uxtheme.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\riched32.dll" "$status": "c0000034"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\riched32.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\RICHED20.dll" "$status": "c0000034"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\RICHED20.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\USP10.dll" "$status": "c0000034"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\USP10.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\msls31.dll" "$status": "c0000034"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\msls31.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\dwmapi.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe.Local\\" "$status": "c0000034"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tiptsf.dll"}50:T1213,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "664" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "708" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "144115188075856600" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "563057327604468" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "-483345294390459660" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "996432413456" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "-7453907409971444952" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "8574567748770726696" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "128" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "984" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "50932986371113944" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "213352586328146904" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "213352689407362008" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "904" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "983551" "TokenHandle": "4294968272" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "916" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "912" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "972" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "1100" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "968" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "50907199387468748" "$name": "C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe"}51:T118e,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "8451748314218496000" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51584790607953920" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51585220104683520" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51565068118130688" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51565497614860288" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "8396379227926036480" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51584928046907392" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51585357543636992" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51565205557084160" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51565635053813760" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51583759815802880" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51584189312532480" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51564037325979648" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "51564466822709248" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "1" "TokenHandle": "996432412672" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "50979921773723648" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "50980351270453248" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "8416788654818590720" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "50899245108035584" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "50899674604765184" "$status": "c000007c"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "50879522618212352" "$status": "c000007c"}52:T8d0,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\UpdatSupport1523\client32.exe (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter UpdatSupport1523\client32.ini (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\UpdatSupport1523\client32.ini (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter UpdatSupport1523\HTCTL32.DLL (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\UpdatSupport1523\HTCTL32.DLL (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter UpdatSupport1523\msvcr100.dll (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\UpdatSupport1523\msvcr100.dll (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter UpdatSupport1523\nskbfltr.inf (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\UpdatSupport1523\nskbfltr.inf (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter UpdatSupport1523\NSM.LIC (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\UpdatSupport1523\nsm_vpro.ini (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter UpdatSupport1523\pcicapi.dll (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\UpdatSupport1523\pcicapi.dll (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter UpdatSupport1523\remcmdstub.exe (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\UpdatSupport1523\TCCTL32.DLL (UID: 00000000-00003320) "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "FindFirstFileW" with parameter C:\03e0d9b601defd28ce944f96c8a0ad5b.exe (UID: 00000000-00003320)53:Tb4e,Found reference to API "GetDC" (Indicator: "GetDC"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003320.00000000.77878.02C90000.00000004.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00003320.00000000.77878.72461000.00000020.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")54:Tb37,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "PCICHEK.DLL") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")55:T521,Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")56:T8dc,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003320.00000000.77878.724C7000.00000002.mdmp")57:T420,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp")58:T7e5,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "TCCTL32.DLL.925006637") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00003320.00000000.77878.06880000.00000004.mdmp")59:T990,Found string "Enter password" (Indicator: "password"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found string "&Enter password for the encrypted file:" (Indicator: "password"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found string "Cannot create folder %sHChecksum error in the encrypted file %s. Corrupt file or wrong password." (Indicator: "password"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found string "Wrong password for %s5Write error in the file %s. Probably the disk is full" (Indicator: "password"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found string "Unknown encryption method in %s$The specified password is incorrect." (Indicator: "password"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found string "in %s$The specified password is incorrect." (Indicator: "password"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found string "Enter password" (Indicator: "password"; Source: "00000000-00003320.00000000.77878.0044D000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found string "&Enter password for the encrypted file:" (Indicator: "password"; Source: "00000000-00003320.00000000.77878.0044D000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found string "Cannot create folder %sHChecksum error in the encrypted file %s. Corrupt file or wrong password." (Indicator: "password"; Source: "00000000-00003320.00000000.77878.0044D000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found string "Wrong password for %s5Write error in the file %s. Probably the disk is full" (Indicator: "password"; Source: "00000000-00003320.00000000.77878.0044D000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found string "Unknown encryption method in %s$The specified password is incorrect." (Indicator: "password"; Source: "00000000-00003320.00000000.77878.0044D000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp")5a:T458,Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: client32.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: pcicapi.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: AudioCapture.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: remcmdstub.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: PCICL32.DLL] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: TCCTL32.DLL] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: HTCTL32.DLL]5b:T63e,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "PCICHEK.DLL") file/memory contains long string with (Indicator: "TerminateProcess"; File: "PCICHEK.DLL") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp")5c:T511,Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp")5d:T1310,Observed import api "SetFileSecurityW" which can "Sets the security of a file or directory object" [Source: ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: pcicapi.dll] Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: PCICL32.DLL] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: PCICL32.DLL] Observed import api "AllocateLocallyUniqueId" which can "Allocates a locally unique identifier (LUID)" [Source: PCICL32.DLL] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: PCICL32.DLL] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: PCICL32.DLL] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: PCICL32.DLL] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: PCICL32.DLL] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: PCICL32.DLL] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: PCICL32.DLL] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: PCICL32.DLL] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: PCICL32.DLL] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: PCICL32.DLL] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: PCICL32.DLL] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: PCICL32.DLL] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: PCICL32.DLL] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: PCICL32.DLL] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: PCICL32.DLL] Observed import api "SetSecurityDescriptorSacl" which can "Sets information in a system access control list (SACL)" [Source: PCICL32.DLL] Observed import api "SetTokenInformation" which can "Sets various types of information for a specified access token" [Source: PCICL32.DLL] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: TCCTL32.DLL] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: TCCTL32.DLL] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: TCCTL32.DLL] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: HTCTL32.DLL] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: HTCTL32.DLL] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: HTCTL32.DLL]5e:Tabe,"03e0d9b601defd28ce944f96c8a0ad5b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "03e0d9b601defd28ce944f96c8a0ad5b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\UPDATSUPPORT1523\CLIENT32.EXE"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")5f:T1e24,"03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "604" "processHandle": "4294967295" "baseAddress": "2caeb48" "zeroBits": "0" "commitSize": "0" "viewSize": "299008" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "668" "processHandle": "4294967295" "baseAddress": "2cad808" "zeroBits": "0" "commitSize": "0" "viewSize": "24576" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "668" "processHandle": "4294967295" "baseAddress": "2cae048" "zeroBits": "0" "commitSize": "0" "viewSize": "516096" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "668" "processHandle": "4294967295" "baseAddress": "2cadee8" "zeroBits": "0" "commitSize": "0" "viewSize": "94208" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "668" "processHandle": "4294967295" "baseAddress": "2caebf8" "zeroBits": "0" "commitSize": "0" "viewSize": "204800" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "680" "processHandle": "4294967295" "baseAddress": "2cada18" "zeroBits": "0" "commitSize": "0" "viewSize": "1327104" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "696" "processHandle": "4294967295" "baseAddress": "2cae518" "zeroBits": "0" "commitSize": "0" "viewSize": "143360" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "736" "processHandle": "4294967295" "baseAddress": "2cad758" "zeroBits": "0" "commitSize": "0" "viewSize": "532480" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "768" "processHandle": "4294967295" "baseAddress": "2cad8b8" "zeroBits": "0" "commitSize": "0" "viewSize": "552960" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "944" "processHandle": "4294967295" "baseAddress": "2cadac8" "zeroBits": "0" "commitSize": "0" "viewSize": "487424" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "944" "processHandle": "4294967295" "baseAddress": "2caea98" "zeroBits": "0" "commitSize": "0" "viewSize": "2310144" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "944" "processHandle": "4294967295" "baseAddress": "2cadc28" "zeroBits": "0" "commitSize": "0" "viewSize": "573440" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "944" "processHandle": "4294967295" "baseAddress": "2cadb78" "zeroBits": "0" "commitSize": "0" "viewSize": "163840" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1092" "processHandle": "4294967295" "baseAddress": "2cae938" "zeroBits": "0" "commitSize": "0" "viewSize": "90112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1092" "processHandle": "4294967295" "baseAddress": "2cae1a8" "zeroBits": "0" "commitSize": "0" "viewSize": "221184" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "984" "processHandle": "4294967295" "baseAddress": "2cae678" "zeroBits": "0" "commitSize": "0" "viewSize": "77824" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1076" "processHandle": "4294967295" "baseAddress": "2cae258" "zeroBits": "0" "commitSize": "0" "viewSize": "1548288" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1192" "processHandle": "4294967295" "baseAddress": "2caf018" "zeroBits": "0" "commitSize": "0" "viewSize": "53248" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\srvcli.dll"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1164" "processHandle": "4294967295" "baseAddress": "2caf4e8" "zeroBits": "0" "commitSize": "0" "viewSize": "819200" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1200" "processHandle": "4294967295" "baseAddress": "2caf2d8" "zeroBits": "0" "commitSize": "0" "viewSize": "114688" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1224" "processHandle": "4294967295" "baseAddress": "2caf648" "zeroBits": "0" "commitSize": "0" "viewSize": "61440" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1324" "processHandle": "4294967295" "baseAddress": "2cae5c8" "zeroBits": "0" "commitSize": "0" "viewSize": "4231168" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1324" "processHandle": "4294967295" "baseAddress": "2cae888" "zeroBits": "0" "commitSize": "0" "viewSize": "667648" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1324" "processHandle": "4294967295" "baseAddress": "2d2f7a8" "zeroBits": "0" "commitSize": "0" "viewSize": "581632" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "03e0d9b601defd28ce944f96c8a0ad5b.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "1324" "processHandle": "4294967295" "baseAddress": "2d2f4e8" "zeroBits": "0" "commitSize": "0" "viewSize": "176128" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"}60:T679,Dropped file: "client32.exe" - Location: [%APPDATA%\UpdatSupport1523\client32.exe]- [targetUID: 00000000-00003968] Dropped file: "pcicapi.dll" - Location: [%APPDATA%\UpdatSupport1523\pcicapi.dll]- [targetUID: 00000000-00003968] Dropped file: "AudioCapture.dll" - Location: [%APPDATA%\UpdatSupport1523\AudioCapture.dll]- [targetUID: 00000000-00003320] Dropped file: "remcmdstub.exe" - Location: [%APPDATA%\UpdatSupport1523\remcmdstub.exe]- [targetUID: 00000000-00003320] Dropped file: "autorun29.ini.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\autorun29.ini.lnk]- [targetUID: 00000000-00003320] Dropped file: "nskbfltr.inf" - Location: [%APPDATA%\UpdatSupport1523\nskbfltr.inf]- [targetUID: 00000000-00003320] Dropped file: "PCICL32.DLL" - Location: [%APPDATA%\UpdatSupport1523\PCICL32.DLL]- [targetUID: 00000000-00003968] Dropped file: "TCCTL32.DLL" - Location: [%APPDATA%\UpdatSupport1523\TCCTL32.DLL]- [targetUID: 00000000-00003320] Dropped file: "HTCTL32.DLL" - Location: [%APPDATA%\UpdatSupport1523\HTCTL32.DLL]- [targetUID: 00000000-00003968] Dropped file: "PCICHEK.DLL" - Location: [%APPDATA%\UpdatSupport1523\PCICHEK.DLL]- [targetUID: 00000000-00003968] Dropped file: "NSM.ini" - Location: [%APPDATA%\UpdatSupport1523\NSM.ini]- [targetUID: 00000000-00003320] Dropped file: "client32.ini" - Location: [%APPDATA%\UpdatSupport1523\client32.ini]- [targetUID: 00000000-00003968] Dropped file: "NSM.LIC" - Location: [%APPDATA%\UpdatSupport1523\NSM.LIC]- [targetUID: 00000000-00003968] Dropped file: "nsm_vpro.ini" - Location: [%APPDATA%\UpdatSupport1523\nsm_vpro.ini]- [targetUID: 00000000-00003320]61:T6d4,"03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Windows\win.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "03e0d9b601defd28ce944f96c8a0ad5b.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "client32.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.ini"62:T530,"client32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\client32.exe]- [targetUID: 00000000-00003968] "pcicapi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\pcicapi.dll]- [targetUID: 00000000-00003968] "AudioCapture.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\AudioCapture.dll]- [targetUID: 00000000-00003320] "remcmdstub.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\remcmdstub.exe]- [targetUID: 00000000-00003320] "PCICL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\PCICL32.DLL]- [targetUID: 00000000-00003968] "TCCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\TCCTL32.DLL]- [targetUID: 00000000-00003320] "HTCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\HTCTL32.DLL]- [targetUID: 00000000-00003968] "PCICHEK.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\UpdatSupport1523\PCICHEK.DLL]- [targetUID: 00000000-00003968]63:T6ad,"03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote 2304 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\client32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote 15616 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\msvcr100.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\PCICHEK.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote 38912 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\UpdatSupport1523\remcmdstub.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...64:T66e,RegCreateKeyExW RegCloseKey OpenProcessToken RegOpenKeyExW GetFileAttributesW OpenFileMappingW GetTempPathW DeviceIoControl GetModuleFileNameW IsDebuggerPresent GetModuleFileNameA UnhandledExceptionFilter CreateThread TerminateProcess LoadLibraryW GetTickCount LoadLibraryA GetStartupInfoA CreateDirectoryW DeleteFileW GetProcAddress CreateFileMappingW WriteFile FindNextFileW FindFirstFileW CreateFileW CreateFileA GetCommandLineW GetCommandLineA MapViewOfFile GetModuleHandleW FindResourceW Sleep VirtualAlloc ShellExecuteExW FindWindowExW GetModuleHandleA GetVersionExA OpenProcess GetTempPathA OutputDebugStringA GetStartupInfoW CreateProcessA RegDeleteKeyA StartServiceA RegDeleteValueA RegCreateKeyExA RegCreateKeyA SetSecurityDescriptorDacl GetUserNameW CreateProcessAsUserA RegEnumKeyA RegEnumKeyExA StartServiceCtrlDispatcherA GetUserNameA RegOpenKeyExA CreateFileMappingA GetFileAttributesA LockResource GetDriveTypeA DisconnectNamedPipe OpenFileMappingA GetThreadContext FindResourceExA ConnectNamedPipe WriteProcessMemory CopyFileA LoadLibraryExA ExitThread VirtualProtect GetSystemDirectoryA CreateRemoteThread WinExec GetFileSize CreateDirectoryA DeleteFileA ReadProcessMemory VirtualProtectEx FindFirstFileA GetTempFileNameA GetComputerNameA FindNextFileA GetSystemInfo FindResourceA ShellExecuteA GetCursorPos GetClipboardData GetLastActivePopup FindWindowExA SetWindowsHookExA FindWindowA GetWindowThreadProcessId GetUpdateRect InternetCrackUrlA EnumPrintersA recv socket bind send accept WSAStartup connect closesocket listen65:T131a,"03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "b084df72a0aae1725085df728087df72f086df72" to virtual address "0x74C34000" (part of module "MSCTF.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "408a2975306c2a7570c62a75f0412a7500bd2a7510302a75a0cc2a7520412a7520872a759084297560a32a7590a22a75d0f42a75e0032b75a0e12875402c2b7570d8287570c72a7550512e75c0912a7550892a757035287520ef2a75" to virtual address "0x749C0118" (part of module "SHLWAPI.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "40d20974300d0a74c0cd0974" to virtual address "0x755C0058" (part of module "COMBASE.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "801f5777a05a5877e0945877d07b5877b01e5777d01d5777f0e35a77703f587750fa5577a0805677" to virtual address "0x7531E138" (part of module "GDI32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "708c1774503c1774c02d1774908f1774c0201774b09517743025177470471774402d1774f0bb177430491774a026177440941774308e1774c080177450b81774d0271774c0ce1774f0261774d0941774a0841774" to virtual address "0x730D0100" (part of module "COMCTL32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "00414a75003d4a75608a4275b0ff447500914275b0074875e0b6447550b64475b0f0437500924a7550bc4475b0ff477590414a7570b7447510c74a7580044475" to virtual address "0x74159058" (part of module "CLBCATQ.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "907c5877002b58770039587770a25877b0af5877708c557750745577d0d05a7760af587780805877b0845877f05f587730a35877" to virtual address "0x7531E060" (part of module "GDI32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "600bb874" to virtual address "0x72EE003C" (part of module "TEXTINPUTFRAMEWORK.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "30ae3675" to virtual address "0x74471094" (part of module "RPCRT4.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "f04c5877c056587730085877c0615777606e587700555877504f5877f0435877501a587750b55a77c01b5877f031587750675877" to virtual address "0x7531E164" (part of module "GDI32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "705b3075906a307540373075f06b307570683075d06a3075e0453075e03a3075e0683075b0693075b06b3075b0553075506a3075b0713075406b307530693075806d3075707a307590373075" to virtual address "0x7418D000" (part of module "IMM32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "d0d00f7490d10f74" to virtual address "0x755C00C4" (part of module "COMBASE.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "702b997440389a744079997460099a74e026997460169974a01a9974801d9974e01a9974d077997420229974b07b9974e02a9974406b9a74c03d997460459974206c99741040997470449974203d997480639974303c9a7450269974" to virtual address "0x76044158" (part of module "SHELL32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "90414a75a0f94975b0f0437500414a75b0074875603c4875b0ff4475106e4475606e44758004447500de4075608a427570f04975" to virtual address "0x749C01BC" (part of module "SHLWAPI.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "c085367700c03677a0d53677805a367740213677c0b43677" to virtual address "0x749C033C" (part of module "SHLWAPI.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "00895877" to virtual address "0x7531E010" (part of module "GDI32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "8053ea7250f6e77270ede972" to virtual address "0x74C34024" (part of module "MSCTF.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "d05f5577007e5577905c587740985877e0a1557720685877d0d55577104e5577703455773071557700315877807458774012587720425877e0af5877" to virtual address "0x7531E098" (part of module "GDI32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "7058587740c55a7740825877009a5b778078557700735577d0145877707d5577002d57776076557720775877c07c5577904f55771066587710365877a07e587770a2557730365577" to virtual address "0x7531E0D8" (part of module "GDI32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "d0e45877c0e45877a0dc587720b1587790af5877f0565877e0865c7720c7587740ec587720ee5877" to virtual address "0x7531E958" (part of module "GDI32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "10765877a05f587730d55577f0565577a0e75a77e07b5577b0d65a77b024567710455877204d587790e55a77" to virtual address "0x7531E19C" (part of module "GDI32.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "d04cef727064ef72f040ef72003fef72205def72606bef72f028f072c03cef72" to virtual address "0x73952078" (part of module "UXTHEME.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "10066a77" to virtual address "0x72EE0000" (part of module "TEXTINPUTFRAMEWORK.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "30660f77100c0f7770230f77" to virtual address "0x751F15F0" (part of module "WINDOWS.STORAGE.DLL") "03e0d9b601defd28ce944f96c8a0ad5b.exe" wrote bytes "e03a5877e0025877f03d5877" to virtual address "0x7531E000" (part of module "GDI32.DLL")66:T554,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADxElEQVR4Xu2XyU8TYRjG/Y9c4nZ1uXj3ZjRu0YtGr5po2NdCkRCgLYW20Iq1osEFpTaoBOWo1oNGRQ6ikBLZu7A9zvO133Q6mx29OskTSiDz+73v933vTHfs+H+ZXOFwGMzAwAD6+/sRCoUQDIYQCAYRCATQ19eH3t5e+P296PH74evpgdfng9frg8fjhV/5W0dHB/T3LfsifGtry5BNbTb12cT29jYikQimp6eF1F9LsHICNzY2sM6sy6wjJ5PL/8zmZHJCggLLy8v4+nUKHq8X7r+RYNvNBFQ4P9sILCwsYH5+Hh8/fUJXtwdut9uZBNecAgJuJkC4CjYKpFIpzM3NYWZmBslkEp2dXc4EuOFUAav2a8B6AZfLVZK29nZnAtztQkCF27Q/WxTg51ml8p+zMrNKN+bRduuWQwHlqEmBIlgDN2m/FMhok8kq+2gT7jaHAjznPGp/hOuqLxXIqgKt7jZnAhwyeQF2oAgu3fkauFn1ikC6INDS6vAUcMJxuJiD+buE21cvBVytrc4EOF5FB3Tg0rZbwYvVS4HmlhZnAhyj7IABrMKLbTeDy+pVAZdDAT5YeKZViFbEAVwKNDW7HAp4KaDtQAFqC88Z4HmBDTQ2NTsT4CNV7YAOago2qVyG07ShqcmZQLfHkxfQQM3B9vB0OiME6httBCYnJ8G8ef0aExMTGB8fx6uXr/DyxQuMjY0hkUjgefw54qOjePb0GUbj8bLhawWBuoZGewGuU7l58vixCv4TXBWob7AWYOW8cSaTwYcvszh6NYqDF8OGpNNp8X+PHj60BuvgUqC2rt5agG2XAkzyy08cuTKIAxdCJaEAH8nDw8NGaCFasFagpq7OWoBrrhc4fDmM/ecDJVlbWxMCD+4/MID1VesFqmttBLjhpEDy8w8cutSPfef8pTnrx+rqqngG3B8aKgusFaiqqbUW4G6XAucbhrH3rM+YMz6srKwIgXuxWFlgrUBldY21AI8aBVK/lrDntKeQbpFY4r0IP/NNN6vs/lg0aoDYRQhUVVsL8JxTYOp7CrtPdamJJd6JtrPyaPwtlpaWhEB08I4BYhcKVNgJcMjIJTh2NYhdJztw/FpEhbNywhcXF4XAYOR28W25zNysrLIW4ISjAG8+8W4KO0+043TVXbHrtRIMJSPKtybOdo5XTjgOGZ5zHjXudm44rjnbzsoJv1FRaS3A8SqnHI/Zm/ffcL1zJP/Wo0jJyGM6oHxp0d/jn66RkRExXjnhOGR4znnUuNu54bjmbDsrJzygvC/q7/Ev129J2EY7Lg9T1QAAAABJRU5ErkJggg==67:T554,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADxElEQVR4Xu2XyU8TYRjG/Y9c4nZ1uXj3ZjRu0YtGr5po2NdCkRCgLYW20Iq1osEFpTaoBOWo1oNGRQ6ikBLZu7A9zvO133Q6mx29OskTSiDz+73v933vTHfs+H+ZXOFwGMzAwAD6+/sRCoUQDIYQCAYRCATQ19eH3t5e+P296PH74evpgdfng9frg8fjhV/5W0dHB/T3LfsifGtry5BNbTb12cT29jYikQimp6eF1F9LsHICNzY2sM6sy6wjJ5PL/8zmZHJCggLLy8v4+nUKHq8X7r+RYNvNBFQ4P9sILCwsYH5+Hh8/fUJXtwdut9uZBNecAgJuJkC4CjYKpFIpzM3NYWZmBslkEp2dXc4EuOFUAav2a8B6AZfLVZK29nZnAtztQkCF27Q/WxTg51ml8p+zMrNKN+bRduuWQwHlqEmBIlgDN2m/FMhok8kq+2gT7jaHAjznPGp/hOuqLxXIqgKt7jZnAhwyeQF2oAgu3fkauFn1ikC6INDS6vAUcMJxuJiD+buE21cvBVytrc4EOF5FB3Tg0rZbwYvVS4HmlhZnAhyj7IABrMKLbTeDy+pVAZdDAT5YeKZViFbEAVwKNDW7HAp4KaDtQAFqC88Z4HmBDTQ2NTsT4CNV7YAOago2qVyG07ShqcmZQLfHkxfQQM3B9vB0OiME6httBCYnJ8G8ef0aExMTGB8fx6uXr/DyxQuMjY0hkUjgefw54qOjePb0GUbj8bLhawWBuoZGewGuU7l58vixCv4TXBWob7AWYOW8cSaTwYcvszh6NYqDF8OGpNNp8X+PHj60BuvgUqC2rt5agG2XAkzyy08cuTKIAxdCJaEAH8nDw8NGaCFasFagpq7OWoBrrhc4fDmM/ecDJVlbWxMCD+4/MID1VesFqmttBLjhpEDy8w8cutSPfef8pTnrx+rqqngG3B8aKgusFaiqqbUW4G6XAucbhrH3rM+YMz6srKwIgXuxWFlgrUBldY21AI8aBVK/lrDntKeQbpFY4r0IP/NNN6vs/lg0aoDYRQhUVVsL8JxTYOp7CrtPdamJJd6JtrPyaPwtlpaWhEB08I4BYhcKVNgJcMjIJTh2NYhdJztw/FpEhbNywhcXF4XAYOR28W25zNysrLIW4ISjAG8+8W4KO0+043TVXbHrtRIMJSPKtybOdo5XTjgOGZ5zHjXudm44rjnbzsoJv1FRaS3A8SqnHI/Zm/ffcL1zJP/Wo0jJyGM6oHxp0d/jn66RkRExXjnhOGR4znnUuNu54bjmbDsrJzygvC/q7/Ev129J2EY7Lg9T1QAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792514682558,"unified_at":"2026-10-20T16:44:42.558Z","metadata":{"hashes":{"sha256":"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6","sha1":"84660c1af8dc9503df589cab0cd00a248db348ea","md5":"03e0d9b601defd28ce944f96c8a0ad5b","sha512":"76eca2a142a8a3429acd3034bf3069922d1785aabcad6070427fbcb99d6888f4128b84e1ae93f3dd1ec7ffc096b2242453714d20fa83fe657f7ad279be6cf09f","ssdeep":"24576:1dh179upZwOO+MvxNgenB+D6qVstij7t8aCfQTWHENTdIGoRUvuy/6i/47NDuJM8:PBGrwxNgSB+D6deNCTEzmRj6oNNeUE","ssdeep_chunks":["24576:1dh179u","24576:dh179up","24576:h179upZ","24576:179upZw","24576:79upZwO","24576:9upZwOO","24576:upZwOO+","24576:pZwOO+M","24576:ZwOO+Mv","24576:wOO+Mvx","24576:OO+MvxN","24576:O+MvxNg","24576:+MvxNge","24576:MvxNgen","24576:vxNgenB","24576:xNgenB+","24576:NgenB+D","24576:genB+D6","24576:enB+D6q","24576:nB+D6qV","24576:B+D6qVs","24576:+D6qVst","24576:D6qVsti","24576:6qVstij","24576:qVstij7","24576:Vstij7t","24576:stij7t8","24576:tij7t8a","24576:ij7t8aC","24576:j7t8aCf","24576:7t8aCfQ","24576:t8aCfQT","24576:8aCfQTW","24576:aCfQTWH","24576:CfQTWHE","24576:fQTWHEN","24576:QTWHENT","24576:TWHENTd","24576:WHENTdI","24576:HENTdIG","24576:ENTdIGo","24576:NTdIGoR","24576:TdIGoRU","24576:dIGoRUv","24576:IGoRUvu","24576:GoRUvuy","24576:oRUvuy/","24576:RUvuy/6","24576:Uvuy/6i","24576:vuy/6i/","24576:uy/6i/4","24576:y/6i/47","24576:/6i/47N","24576:6i/47ND","24576:i/47NDu","24576:/47NDuJ","24576:47NDuJM","24576:7NDuJM8","49152:1dh179u","49152:dh179up","49152:h179upZ","49152:179upZw","49152:79upZwO","49152:9upZwOO","49152:upZwOO+","49152:pZwOO+M","49152:ZwOO+Mv","49152:wOO+Mvx","49152:OO+MvxN","49152:O+MvxNg","49152:+MvxNge","49152:MvxNgen","49152:vxNgenB","49152:xNgenB+","49152:NgenB+D","49152:genB+D6","49152:enB+D6q","49152:nB+D6qV","49152:B+D6qVs","49152:+D6qVst","49152:D6qVsti","49152:6qVstij","49152:qVstij7","49152:Vstij7t","49152:stij7t8","49152:tij7t8a","49152:ij7t8aC","49152:j7t8aCf","49152:7t8aCfQ","49152:t8aCfQT","49152:8aCfQTW","49152:aCfQTWH","49152:CfQTWHE","49152:fQTWHEN","49152:QTWHENT","49152:TWHENTd","49152:WHENTdI","49152:HENTdIG","49152:ENTdIGo","49152:NTdIGoR","49152:TdIGoRU","49152:dIGoRUv","49152:IGoRUvu","49152:GoRUvuy","49152:oRUvuy/","49152:RUvuy/6","49152:Uvuy/6i","49152:vuy/6i/","49152:uy/6i/4","49152:y/6i/47","49152:/6i/47N","49152:6i/47ND","49152:i/47NDu","49152:/47NDuJ","49152:47NDuJM","49152:7NDuJM8","24576:PBGrwxN","24576:BGrwxNg","24576:GrwxNgS","24576:rwxNgSB","24576:wxNgSB+","24576:xNgSB+D","24576:NgSB+D6","24576:gSB+D6d","24576:SB+D6de","24576:B+D6deN","24576:+D6deNC","24576:D6deNCT","24576:6deNCTE","24576:deNCTEz","24576:eNCTEzm","24576:NCTEzmR","24576:CTEzmRj","24576:TEzmRj6","24576:EzmRj6o","24576:zmRj6oN","24576:mRj6oNN","24576:Rj6oNNe","24576:j6oNNeU","24576:6oNNeUE"],"imphash":"3eaa732d4dae53340f9646bdd85dac41"},"file_info":{"file_name":"03e0d9b601defd28ce944f96c8a0ad5b.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2228467,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1684831807000,"last_seen":1684831808000,"last_multi_scan":1684831808000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","netsupportrat","rat","repurposedlegitimatesoftware"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":189,"suspicious_count":18,"malicious_count":7,"total":214},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Spy.ChePro.cmyvd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.67114257","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Starter-287","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.67114257 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.Win32.ChePro.njmf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Calls an API typically used to map section into the virtual address space of a process"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"},{"type":"informative","value":"Calls an API typically used to register protocol sequence (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains long base64 encoded strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API typically used to terminate process and its threads"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"FindResourceW\" with parameter \"4351828\" - (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"FindResourceW\" with parameter \"789\" - (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"LoadResource with parameter \" (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"LoadResource with parameter {'hModule': '128843776', 'hResInfo': '128852096'}\" (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"HTCTL32.DLL\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains long base64 encoded strings","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-500","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003320.00000000.77878.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003320.00000000.77878.06779000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003320.00000000.77878.71ED0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003320.00000000.77878.72460000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n file/memory contains long string with (Indicator: \"IsDebuggerPresent\"; File: \"PCICHEK.DLL\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n file/memory contains long string with (Indicator: \"SetUnhandledExceptionFilter\"; File: \"PCICHEK.DLL\")\n file/memory contains long string with (Indicator: \"UnhandledExceptionFilter\"; File: \"PCICHEK.DLL\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 48455-1570-00422759\n SetUnhandledExceptionFilter@KERNEL32.dll at 48455-2477-00421C9E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003320-53303-612-00422759\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003320-53303-1248-00421C9E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003320-53303-16-0041F3AC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003320-53303-17-0041D99B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00003320-53303-181-00410AD1","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.813243202373386","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains long base64 encoded strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains long base64 encoded strings\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cryptography Rijndael\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"IsWow64Process\" with parameter \"3320\" - (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetWindowTextW\" with parameter \"WinRAR self-extracting archive\" - (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetWindowTextW\" (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetWindowTextW\" with parameter \"&Destination folder\" - (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetWindowTextW\" with parameter \"Bro&wse...\" - (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetWindowTextW\" with parameter \"Installation progress\" - (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetWindowTextW\" with parameter \"Install\" - (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetWindowTextW\" with parameter \"%USERPROFILE%\\AppData\\Roaming\" - (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"client32.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003968)\n \"client32.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003968)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 48455-2451-0040F34C\n GetTickCount@KERNEL32.DLL at 00000000-00003320-53303-241-00422575\n GetTickCount@KERNEL32.DLL at 00000000-00003320-53303-1222-0040F34C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 48455-2450-0040DB4C\n FindNextFileW@KERNEL32.dll at 48455-1322-004093B9\n FindFirstFileW@KERNEL32.DLL at 00000000-00003320-53303-1221-0040DB4C\n FindNextFileW@KERNEL32.DLL at 00000000-00003320-53303-364-004093B9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 48455-1364-0041B916\n FileTimeToLocalFileTime@KERNEL32.dll at 48455-2450-0040DB4C\n GetSystemTimeAsFileTime@KERNEL32.dll at 48455-1611-0041B95D\n FileTimeToSystemTime@KERNEL32.dll at 48455-1845-0040DCA1\n FileTimeToLocalFileTime@KERNEL32.dll at 48455-1300-00411004\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00003320-53303-885-0040DCA1\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00003320-53303-1221-0040DB4C\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00003320-53303-342-00411004\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003320-53303-653-0041B95D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003320-53303-241-00422575\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003320-53303-406-0041B916","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 48455-1462-00410F9C\n GetSystemTimeAsFileTime@KERNEL32.dll at 48455-1364-0041B916\n GetSystemTimeAsFileTime@KERNEL32.dll at 48455-1611-0041B95D\n GetSystemTime@KERNEL32.DLL at 00000000-00003320-53303-504-00410F9C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003320-53303-653-0041B95D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003320-53303-241-00422575\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003320-53303-406-0041B916","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 48455-1420-0040CCFF\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003320-53303-462-0040CCFF\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003320-53303-196-00424750","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"client32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set rxblen to %d from %d\" (Indicator: \"set \"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found string \"set txblen to %d from %d\" (Indicator: \"set \"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersionExA\"; File: \"PCICHEK.DLL\")\n file/memory contains long string with (Indicator: \"GetVersion\"; File: \"PCICHEK.DLL\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"remcmdstub.exe.3754310044\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"remcmdstub.exe.3754310044\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"remcmdstub.exe.3754310044\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.dll at 48455-1284-00406550\n OpenProcessToken@ADVAPI32.DLL at 00000000-00003320-53303-326-00406550","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" queries volume information of \"C:\\\" at 00000000-00003320-00000C15-77772710\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00003968-00000C15-81050747\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00006980-00000C15-107801592\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00006980-00000C15-107808152","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" queries volume information of \"C:\\\" at 00000000-00003320-00000C15-77772710\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00003968-00000C15-81050747\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00006980-00000C15-107801592\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00006980-00000C15-107808152","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\03E0D9B601DEFD28CE944F96C8A0AD5B.EXE\")\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CLIENT32.EXE\")\n \"client32.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{3F709462-4AD7-482F-8761-C6ED6AD145A1}\")\n \"client32.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{C412F191-BB15-4E40-9CCC-97E571D2C6BF}\")\n \"client32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\")\n \"client32.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"client32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"CreateDirectoryW\" (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Start Menu (UID: 00000000-00003320)\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"Found reference to native API (Indicator: \"RtlUnwind\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to native API (Indicator: \"RtlUnwind\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to native API (Indicator: \"RtlDllShutdownInProgress\"; Source: \"00000000-00003320.00000000.77878.72461000.00000020.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to native API (Indicator: \"NtSetSystemInformation\"; Source: \"00000000-00003320.00000000.77878.72461000.00000020.mdmp\")\n Found reference to native API (Indicator: \"RtlNtStatusToDosErrorNoTeb\"; Source: \"00000000-00003320.00000000.77878.72461000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"d:\\Projects\\WinRAR\\SFX\\build\\sfxrar32\\Release\\sfxrar.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 48455-1225-00410B55\n Sleep@KERNEL32.dll at 48455-1893-0040F56C\n Sleep@KERNEL32.DLL at 00000000-00003320-53303-214-00420335\n Sleep@KERNEL32.DLL at 00000000-00003320-53303-36-004202E9\n Sleep@KERNEL32.DLL at 00000000-00003320-53303-10-00420426\n Sleep@KERNEL32.DLL at 00000000-00003320-53303-52-004202A4\n Sleep@KERNEL32.DLL at 00000000-00003320-53303-933-0040F56C\n Sleep@KERNEL32.DLL at 00000000-00003320-53303-59-0040FBD4\n WaitForSingleObject@KERNEL32.DLL at 00000000-00003320-53303-267-00410B55","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: pcicapi.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: AudioCapture.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: remcmdstub.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PCICL32.DLL)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: TCCTL32.DLL)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: HTCTL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00003320-53303-177-0040CA7B\n LoadLibraryA@KERNEL32.DLL at 00000000-00003320-53303-13-00423F75","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")\n Found reference to API \"NoRemove 'ShellExecuteHooks'\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003320.00000000.77878.72260000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3b","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"CMCDLLNAME32=mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00003320.00000000.77878.05220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:3320:64:WilError_01\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:3320:168:WilStaging_02\"\n \"SM0:3320:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"pcicapi.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"AudioCapture.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"TCCTL32.DLL\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"HTCTL32.DLL\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"client32.exe\" failed to load missing module \"%APPDATA%\\UpdatSupport1523\\dbghelp.dll\" - [base:0; Status:c0000135]\n \"client32.exe\" failed to load missing module \"NSMTRACE\" - [base:0; Status:c0000135]\n \"client32.exe\" failed to load missing module \"%APPDATA%\\UpdatSupport1523\\CryptPak.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"client32.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"remcmdstub.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"PCICL32.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"TCCTL32.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"HTCTL32.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"PCICHEK.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" loaded module \"C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe\" at 00400000\n \"client32.exe\" loaded module \"%APPDATA%\\UpdatSupport1523\\client32.exe\" at 00BB0000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$3f","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 725D0000\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72550000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75350000\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 729D0000\n \"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75350000\n \"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 729D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 743C0000\n \"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 743C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$41","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$42","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"client32.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"pcicapi.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"AudioCapture.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"PCICL32.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"TCCTL32.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"HTCTL32.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"PCICHEK.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\" has an executable section named \".text\"\n \"client32.exe\" has an executable section named \".text\"\n \"pcicapi.dll\" has an executable section named \".text\"\n \"AudioCapture.dll\" has an executable section named \".text\"\n \"remcmdstub.exe\" has an executable section named \".text\"\n \"PCICL32.DLL\" has an executable section named \".text\"\n \"TCCTL32.DLL\" has an executable section named \".text\"\n \"HTCTL32.DLL\" has an executable section named \".text\"\n \"PCICHEK.DLL\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"217\" [Source: PCICL32.DLL]\n Observed large number of imported APIs from \"USER32.dll\" : \"224\" [Source: PCICL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\" has an writable section named \".data\"\n \"pcicapi.dll\" has an writable section named \".data\"\n \"AudioCapture.dll\" has an writable section named \".data\"\n \"remcmdstub.exe\" has an writable section named \".data\"\n \"PCICL32.DLL\" has an writable section named \".data\"\n \"PCICL32.DLL\" has an writable section named \".tls\"\n \"PCICL32.DLL\" has an writable section named \".hhshare\"\n \"TCCTL32.DLL\" has an writable section named \".data\"\n \"HTCTL32.DLL\" has an writable section named \".data\"\n \"PCICHEK.DLL\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$43","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x17c200\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x152600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x17c11c\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x1525a8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" searching for class \"EDIT\"\n \"client32.exe\" searching for class \"NSMWClass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"client32.exe\" (UID: 00000000-00003968)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 3968 -s 840\" (UID: 00000000-00006456)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6980 -s 812\" (UID: 00000000-00006852)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"client32.exe\" (UID: 00000000-00003968)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 3968 -s 840\" (UID: 00000000-00006456)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6980 -s 812\" (UID: 00000000-00006852)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"client32.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"pcicapi.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"AudioCapture.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"remcmdstub.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"PCICL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"TCCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"HTCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"PCICHEK.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" allocated memory in \"C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe\" with (Protection: \"read/write\")\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" allocated memory in \"C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe\" with (Protection: \"no access\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"nskbfltr.inf\" has type \"Windows setup INFormation\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" queries basic process information of the \"C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe\" (UID: 3320)\n \"client32.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\UpdatSupport1523\\client32.exe\" (UID: 3968)\n \"client32.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\UpdatSupport1523\\client32.exe\" (UID: 6980)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Calls an API typically used to find device information\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\AUTORUN29.INI.LNK\"\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\autorun29.ini.lnk\"\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\AUTORUN29.INI.LNK\"\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\autorun29.ini.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$4d","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register protocol sequence (RPC)","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLEFCFB5221F29863AA2E69AC96D828 (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-220","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"sv.WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"pWSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"sv.WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"pWSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00003320.00000000.77878.03320000.00000002.mdmp\n Observed string: \"Copy the ink to the clipboard.)\" (Indicator: \"copy \") in Source: 00000000-00003320.00000000.77878.724C7000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"sv.setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"optlen <= sizeof (tc.cmd.setsockopt.optval)\" (Indicator: \"setsockopt\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0 404 File not found\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found string \"HTTP/1.0 200\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found string \"HTTP/1.0 400 Malformed request (can only do GET)\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetAddConnection\" which can \"makes a connection to a network resource\" [Source: PCICL32.DLL]\n Observed import api \"WNetCancelConnection\" which can \"cancels an existing network connection\" [Source: PCICL32.DLL]\n Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: PCICL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003320\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"TCCTL32.DLL\"\n YARA signature for RC4 encryption matched on file \"pcicapi.dll\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00003320\"\n YARA signature for RC4 encryption matched on file \"AudioCapture.dll\"\n YARA signature for RC4 encryption matched on file \"HTCTL32.DLL\"\n YARA signature for RC4 encryption matched on file \"msvcr100.dll\"\n YARA signature for RC4 encryption matched on file \"remcmdstub.exe\"\n YARA signature for RC4 encryption matched on file \"PCICL32.DLL\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"remcmdstub.exe.3754310044\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"remcmdstub.exe.3754310044\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEEF162FB86E6CA2F8223449A1C8D5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEFCFB5221F29863AA2E69AC96D828]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEEF162FB86E6CA2F8223449A1C8D5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEEF162FB86E6CA2F8\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"client32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"client32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"28\"\n \"th32ProcessID\": \"3968\"}\n \"client32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"28\"\n \"th32ProcessID\": \"6980\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"$50","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"$51","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetComputerNameW\" (UID: 00000000-00003320)\n \"client32.exe\" called \"GetComputerNameA\" (UID: 00000000-00003968)\n \"client32.exe\" called \"GetComputerNameW\" (UID: 00000000-00003968)\n \"client32.exe\" called \"GetComputerNameA\" (UID: 00000000-00006980)\n \"client32.exe\" called \"GetComputerNameW\" (UID: 00000000-00006980)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"client32.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: PCICL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"pGetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"sv.gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"sv.getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp, 00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003320.00000000.77878.72461000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$59","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"$5a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\03e0d9b601defd28ce944f96c8a0ad5b.exe\"}\n \"client32.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\Users\\\\%OSUSER%\\\\AppData\\\\Roaming\\\\UpdatSupport1523\\\\client32.exe\"}\n \"WerFault.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\SysWOW64\\\\WerFault.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003320.00000000.77878.00A77000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00003320.00000000.77878.72461000.00000020.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00003320.00000000.77878.72461000.00000020.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")\n Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"00000000-00003320.00000000.77878.06880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003320.00000000.77878.00426000.00000002.mdmp, 00000000-00003320.00000000.77878.06779000.00000004.mdmp, 00000000-00003320.00000000.77878.06880000.00000004.mdmp, 00000000-00003320.00000000.77878.09A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$5d","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$5f","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003320.00000000.77878.724C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$60","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"client32.exe\" was detected as \"Borland Delphi 3.0 (???)\"\n \"pcicapi.dll\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"AudioCapture.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"remcmdstub.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"PCICL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"TCCTL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"HTCTL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".reloc with unusual entropies 0.221676205458","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/70 Antivirus vendors marked sample as malicious (74% detection rate)\n 3/14 Antivirus vendors marked sample as malicious (21% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00003320-53303-78-0040BD95","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$62","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$63","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.241.253\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"sfxcmd=\"C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe\"\" (Indicator: \"cmd=\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp, 00000000-00003320.00000000.77878.07800000.00000004.mdmp, 00000000-00003320.00000000.77878.07970000.00000004.mdmp\")\n Found string \"sfxcmd=\"C:\\03e0d9b601defd28ce944f96c8a\" (Indicator: \"cmd=\"; Source: \"00000000-00003320.00000000.77878.02C90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}\n \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" called \"GetKeyState\" (UID: 00000000-00003320)","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"client32.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00003968)\n \"client32.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00006980)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 48455-1-0041CCD8\n GetCommandLineW@KERNEL32.dll at 48455-1893-0040F56C\n GetCommandLineW@KERNEL32.DLL at 00000000-00003320-53303-933-0040F56C\n GetCommandLineA@KERNEL32.DLL at 00000000-00003320-53303-1-0041CCD8\n GetCommandLineW@KERNEL32.DLL at 00000000-00003320-53303-59-0040FBD4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 48455-1893-0040F56C\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003320-53303-127-0040B8D9\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003320-53303-933-0040F56C\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003320-53303-59-0040FBD4\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00003320-53303-223-004220E3\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00003320-53303-11-00420B63","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\__tmp_rar_sfx_access_check_21213468\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\__tmp_rar_sfx_access_check_21213468\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"client32.exe\" claimed CRC 157756 while the actual is CRC 2252488\n \"pcicapi.dll\" claimed CRC 106636 while the actual is CRC 157756\n \"AudioCapture.dll\" claimed CRC 88730 while the actual is CRC 106636\n \"remcmdstub.exe\" claimed CRC 113442 while the actual is CRC 88730\n \"PCICL32.DLL\" claimed CRC 3472625 while the actual is CRC 113442\n \"TCCTL32.DLL\" claimed CRC 395992 while the actual is CRC 3472625\n \"HTCTL32.DLL\" claimed CRC 369208 while the actual is CRC 395992\n \"PCICHEK.DLL\" claimed CRC 29771 while the actual is CRC 369208","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$64","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$65","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/70 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"19/95 Antivirus vendors marked dropped file \"client32.exe\" as malicious (classified as \"RemoteAdmin.NetSup\" with 20% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"19/95 Antivirus vendors marked spawned process \"client32.exe\" (PID: 3968) as malicious (classified as \"RemoteAdmin.NetSup\" with 20% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"03e0d9b601defd28ce944f96c8a0ad5b.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\UpdatSupport1523\\client32.exe\" (Handle: 1624)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"03e0d9b601defd28ce944f96c8a0ad5b.exe\" (UID: 00000000-00003320)\n Spawned process \"client32.exe\" (UID: 00000000-00003968)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 3968 -s 840\" (UID: 00000000-00006456)\n Spawned process \"client32.exe\" (UID: 00000000-00006980)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6980 -s 812\" (UID: 00000000-00006852)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":98,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","netsupportrat","rat","repurposedlegitimatesoftware"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"646c8f72b01420c9660342e4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"03e0d9b601defd28ce944f96c8a0ad5b.exe","analysis_start_time":"2023-05-23T10:03:31+00:00","indicators_count":{"informative":189,"suspicious":62,"malicious":8},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}],"processes":[{"pid":3320,"ppid":0,"name":"03e0d9b601defd28ce944f96c8a0ad5b.exe","command_line":"","sha256":"ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6","normalized_path":"C:\\03e0d9b601defd28ce944f96c8a0ad5b.exe","uid":"00000000-00003320","icon":"$66"},{"pid":3968,"ppid":3320,"name":"client32.exe","command_line":"","sha256":"18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d","normalized_path":"%APPDATA%\\UpdatSupport1523\\client32.exe","parent_uid":"00000000-00003320","uid":"00000000-00003968"},{"pid":6456,"ppid":3968,"name":"WerFault.exe","command_line":"-u -p 3968 -s 840","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003968","uid":"00000000-00006456"},{"pid":6980,"ppid":0,"name":"client32.exe","command_line":"","sha256":"18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d","normalized_path":"%APPDATA%\\UpdatSupport1523\\client32.exe","uid":"00000000-00006980","icon":"$67"},{"pid":6852,"ppid":6980,"name":"WerFault.exe","command_line":"-u -p 6980 -s 812","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006980","uid":"00000000-00006852"}],"all_imported_dlls":["wow64win.dll","kernel32.dll","shlwapi.dll","powrprof.dll","oleaut32.dll","comdlg32.dll","cldapi.dll","propsys.dll","msvcrt.dll","comctl32.dll","VxSSL32.dll","uxtheme.dll","linkinfo.dll","cscapi.dll","msvcp90.dll","urlmon.dll","rpcrt4.dll","ntshrui.dll","msIso.dll","PCICL32.DLL","version.dll","winmmbase.dll","crypt32.dll","msvcp_win.dll","tiptsf.dll","CoreUIComponents.dll","rsaenh.dll","edputil.dll","pcicapi.dll","wintrust.dll","psapi.dll","KernelBase.dll","sechost.dll","profapi.dll","sfc_os.dll","netutils.dll","wininet.dll","windows.storage.dll","ole32.dll","wow64cpu.dll","ucrtbase.dll","SHCore.dll","bcrypt.dll","riched32.dll","GROOVEEX.DLL","imagehlp.dll","aepic.dll","cryptsp.dll","wsock32.dll","dbghelp.dll","CoreMessaging.dll","ATL90.dll","pcacli.dll","PCICHEK.DLL","msasn1.dll","ntdll.dll","sspicli.dll","cryptbase.dll","advapi32.dll","mpr.dll","IPHLPAPI.DLL","imm32.dll","msls31.dll","user32.dll","bcryptprimitives.dll","combase.dll","sfc.dll","usp10.dll","WinTypes.dll","srvcli.dll","Windows.StateRepositoryPS.dll","win32u.dll","gdi32.dll","setupapi.dll","ws2_32.dll","msvcr90.dll","shfolder.dll","dbgcore.dll","devobj.dll","wow64.dll","gdi32full.dll","kernel.appcore.dll","dwmapi.dll","clbcatq.dll","ntmarta.dll","AcLayers.dll","cfgmgr32.dll","msvcr100.dll","wtsapi32.dll","shell32.dll","riched20.dll","TextInputFramework.dll","iertutil.dll","apphelp.dll","fltLib.dll","msctf.dll","winmm.dll","HTCTL32.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"PCICHEK.DLL","sha256":"c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"PCICL32.DLL","sha256":"cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"client32.exe","sha256":"18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"remcmdstub.exe","sha256":"e14c3224215ea91587e96b995861e8966166dfc08ab4d409bd729770815b3b81","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"AudioCapture.dll","sha256":"31d920cb14e5d201b2a01de7c9fae6767fe627f585edcab6d8592271c1cf1755","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"HTCTL32.DLL","sha256":"c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"TCCTL32.DLL","sha256":"47162edd0cf12cd37eacc44e4da35734b94f6e5a202be435c5c7a9e51eb0f3ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"pcicapi.dll","sha256":"f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"autorun29.ini.lnk.bin","sha256":"a9e13d2e3b32c66afe49d101c41a1cc95ad17bab91e41df5c0c6c363324885ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"autorun29.ini.lnk","sha256":"a9e13d2e3b32c66afe49d101c41a1cc95ad17bab91e41df5c0c6c363324885ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"NSM.LIC","sha256":"fcc6afd664a8045bd61c398be3c37a97536a199a48d277e11977f93868ae1acc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"NSM.ini","sha256":"e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"client32.ini","sha256":"73de14a74e1c47c8a8afe8bf358c645b99a213494fdd1ba2c61de0d2d7c2521a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"nskbfltr.inf","sha256":"d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"nsm_vpro.ini","sha256":"4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]}],"files_written":[{"path":"C:\\UpdatSupport1523","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\autorun29.ini.lnk","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\UpdatSupport1523\\SUPPORT\\CLIENT32.1_2023_05_23_030908.DMP","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\UpdatSupport1523\\client32.1_2023_05_23_030908.dmp","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\UpdatSupport1523\\SUPPORT\\CLIENT32.1_2023_05_23_030936.DMP","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"path":"%APPDATA%\\UpdatSupport1523\\client32.1_2023_05_23_030936.dmp","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:3320:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"Local\\SM0:3320:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"SM0:3320:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"646c8f72b01420c9660342e4"}]}]}},"report_ids":{"sandbox_job_ids":["646c8f72b01420c9660342e4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample ffeeafbe114f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ffeeafbe114f…. Malware family: Trojan.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample ffeeafbe114f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ffeeafbe114f…. Malware family: Trojan.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ffeeafbe114f78fcb04e240eb2d5b74d32ea0e271cea9334c59e18d3ac3257d6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample ffeeafbe114f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ffeeafbe114f…. Malware family: Trojan.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L68","11",{}]]