24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/Lazarus Sample 6829b51523f6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6829b51523f6…. Malware family: Trojan/Lazarus. Threat score 100/100. 1/24 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652","keywords":["Malicious","Trojan/Lazarus","malware analysis","sandbox report","threat intelligence","6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652"],"about":{"@type":"SoftwareApplication","name":"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652","applicationCategory":["msi","data"],"identifier":"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/Lazarus","antivirusDetections":{"malicious":1,"total":24},"behavioralIndicators":{"malicious":4,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T881,"msiexec.exe" called "LoadResource with parameter {'hModule': '1898119170', 'hResInfo': '1836048'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1835728896', 'hResInfo': '1837983440'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1835728896', 'hResInfo': '1837983728'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1835728896', 'hResInfo': '1837983392'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1835728896', 'hResInfo': '1837983360'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '39387137', 'hResInfo': '6947544'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '6946817', 'hResInfo': '7006792'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433912'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433272'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433800'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433048'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433816'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433064'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433832'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433096'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433848'}" (UID: 00000000-00001200) "msiexec.exe" called "LoadResource with parameter {'hModule': '1777139712', 'hResInfo': '1777433128'}" (UID: 00000000-00001200)26:T6be,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "erviceThreadMain: SetWaitableTimer failed." (Indicator: "SetWaitableTimer"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp")27:T442,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp")28:T8d6,"msiexec.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pcchString": "73000000"} "msiexec.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pcchString": "73000000"} "msiexec.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS/pT9HLfNNK8=" "pcchString": "72000000"} "msiexec.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS/pT9HLfNNK8=" "pcchString": "72000000"} "msiexec.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "0R0P0N0L0J0" "cbBinary": "84" "dwFlags": "1" "pcchString": "73000000"} "msiexec.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "0R0P0N0L0J0" "cbBinary": "84" "dwFlags": "1" "pcchString": "73000000"} "msiexec.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "0R0P0N0L0J0" "cbBinary": "84" "dwFlags": "1" "pszString": "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg/4pN+uv5pmq4z/nmS71JzhICEQCac1ULg3aGO9lDD6qLWimH" "pcchString": "72000000"} "msiexec.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "0R0P0N0L0J0" "cbBinary": "84" "dwFlags": "1" "pszString": "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg/4pN+uv5pmq4z/nmS71JzhICEQCac1ULg3aGO9lDD6qLWimH" "pcchString": "72000000"} "msiexec.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI=" "pcchString": "72000000"} "msiexec.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI=" "pcchString": "72000000"}29:T186a,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "2FpT9HLfNNK8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "comodoca" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "Keep" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "User" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "ocsp" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "comodoca" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base64 string in header "2FSSy4IxLVGLp6chnfNtyA8CEAb9" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BQOWA63qAArrPye7uhs" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2F1ixa9bV6uYX8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2a:Tc51,"msiexec.exe" called "RtlGetVersion" with parameter 1401000006000000000000007017000002000000000065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001200) "Updater.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fc98280000000000540000004c992800feffffffd4982800cf003477d6003477c8b72477540000002a0000004c99280000000000a89828000000000010992800 (UID: 00000000-00003468) "Updater.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003468) "Updater.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000009cf1670000004a0020c932018cdd6b02d0f16775e8df6b0295e12f77343d3f00feffffff435c33775059337734020000400200008a054a0088054a001000000080000000ff2b337718f0677520a3fb6cac012f0000002f000100000020c93200180084000600000000d18773ac012f0000002f0088054a0019007f000600000006000000bcee3377f06a2f0000004a00200000001a006b000000000060193400e0672f0000692f00600d3600a86c2f0000004a0080de6b026019340000e06b0295e12f770c333f00feffffffff2b33779a2a337720a3fb6c10a3fb6c00000000 (UID: 00000000-00003468) "Updater.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000002f000080000080863600ac9128000464337738012f00e0633377b0be24770000000000002f00888636006dd1657583c6fd586cae9f750000000000000000a002000060a7360050012f000100000000002f0050012f000c0000008886360050012f000200000218000000113100204f0000000000000000000000030000004c912800800000007f07000000000000113100204f000000c0756d7560a7360000000000c0756d7568912800d02b2f0000000000c02a2f00c0912800dbd265758886360060a736001bc6fd584f000000ff2b337714bd24774896280004022f00 (UID: 00000000-00003468)2b:T487,Found string "SELECT * FROM `%s` WHERE `Property`='%s' AND `Value`='%s'" (Indicator: "select * from "; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found string "SELECT * FROM `%s` WHERE `Property`='%s'" (Indicator: "select * from "; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found string "SELECT * FROM `%s`" (Indicator: "select * from "; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found string "SELECT * FROM `Control` WHERE `Type` = 'Bitmap'" (Indicator: "select * from "; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found string "SELECT * FROM `Control` WHERE `Type` = 'Icon'" (Indicator: "select * from "; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found string "SELECT * FROM `Control` WHERE `Type` = 'PushButton'" (Indicator: "select * from "; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found string "SELECT * FROM `Condition` WHERE `Condition`.`Feature_`='" (Indicator: "select * from "; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652")2c:T736,"Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2d:T408,Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "OpenSCManager failed." (Indicator: "OpenSCManager"; File: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp")2e:T8a2,"msiexec.exe" called "CreateDirectoryW" with parameter C:\ProgramData (UID: 00000000-00001200) "msiexec.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Templates (UID: 00000000-00001200) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Windows (UID: 00000000-00001200) "msiexec.exe" called "CreateDirectoryW" with parameter %WINDIR%\Fonts (UID: 00000000-00001200) "msiexec.exe" called "CreateDirectoryW" with parameter C:\MSI482c3.tmp (UID: 00000000-00001200) "msiexec.exe" called "CreateDirectoryW" with parameter Z:\MSI482c4.tmp (UID: 00000000-00001200) "msiexec.exe" called "CreateDirectoryW" with parameter C:\ProgramData (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Templates (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Windows (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %WINDIR%\Fonts (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Config.Msi (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\CelasTradePro (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\CelasTradePro (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\CelasTradePro\platforms (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %WINDIR%\Installer\{1F1E4AAD-C976-4CC1-B21D-B87B8DDF4620} (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Users\Public (UID: 00000000-00003280) "msiexec.exe" called "CreateDirectoryW" with parameter %PUBLIC%\Desktop (UID: 00000000-00003280)2f:T4fc3,"msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\cryptnet.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sxs.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCOREE.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\fusion.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter MsiHnd.dll (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter KERNEL32 (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter DWMAPI (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USER32.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter USER32 (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter RICHED20.DLL (UID: 00000000-00001200) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SRCLIENT.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter vsstrace.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter OLEAUT32 (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ES.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sxs.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCOREE.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\fusion.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RSTRTMGR.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTDLL.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SFC.DLL (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter CABINET (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003280) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNELBASE.DLL (UID: 00000000-00003280) "MsiExec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %TEMP%\MSI44CF.tmp (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USER32.DLL (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %TEMP%\MSI5959.tmp (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %TEMP%\MSI60D9.tmp (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %TEMP%\MSI6B17.tmp (UID: 00000000-00005432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI3D3F.tmp (UID: 00000000-00005772) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005772) "Updater.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003468) "Updater.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003468)30:T173a8,"msiexec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SHGetPropertyStoreForWindow (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter PSStringFromPropertyKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter PropVariantToString (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SaferiChangeRegistryScope (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter MsiSIPIsMyTypeOfFile (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter MsiSIPPutSignedDataMsg (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter MsiSIPGetSignedDataMsg (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter IsEqualGUID (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WVTAsn1SpcIndirectDataContentDecode (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter MsiSIPVerifyIndirectData (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SetupIterateCabinetW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DevRtlGetThreadLogToken (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SaferiSearchMatchingHashRules (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SaferGetLevelInformation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter ApphelpGetMsiProperties (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SdbInitDatabase (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SdbFindFirstMsiPackage_Str (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SdbReleaseDatabase (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CheckElevationEnabled (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DwmSetWindowAttribute (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter DrawThemeParentBackgroundEx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter CoFreeUnusedLibraries (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001200) "msiexec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CreateWaitableTimerW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CancelWaitableTimer (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter QueryInstanceCount (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoImpersonateClient (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoRevertToSelf (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CreateRestrictedToken (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoGetCallContext (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CreateEnvironmentBlock (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DestroyEnvironmentBlock (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SRSetRestorePointW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter StringFromCLSID (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DsRoleGetPrimaryDomainInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DsRoleFreeMemory (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BSTR_UserSize (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BSTR_UserMarshal (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BSTR_UserUnmarshal (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BSTR_UserFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter VARIANT_UserSize (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter VARIANT_UserMarshal (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter VARIANT_UserUnmarshal (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter VARIANT_UserFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LPSAFEARRAY_UserFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter PropVariantToVariant (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NetLocalGroupGetMembers (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamConnect (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamOpenDomain (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamLookupNamesInDomain (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamOpenAlias (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamFreeMemory (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamCloseHandle (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamGetMembersInAlias (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamEnumerateDomainsInSamServer (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SamLookupDomainInSamServer (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SaferiChangeRegistryScope (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToProxyStubCLSID (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToTLBPath (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LPSAFEARRAY_UserSize (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LPSAFEARRAY_UserMarshal (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LPSAFEARRAY_UserUnmarshal (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter MsiSIPIsMyTypeOfFile (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter MsiSIPPutSignedDataMsg (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter MsiSIPGetSignedDataMsg (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NlsGetCacheUpdateCount (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter IsEqualGUID (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WVTAsn1SpcIndirectDataContentDecode (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter MsiSIPVerifyIndirectData (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinStationRegisterNotificationEvent (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SaferiSearchMatchingHashRules (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter UnregisterGPNotificationInternal (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SaferGetLevelInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter ApphelpGetMsiProperties (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SdbInitDatabase (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SdbFindFirstMsiPackage_Str (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SdbReleaseDatabase (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsForUserW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CheckElevationEnabled (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RtlCreateEnvironment (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RtlDestroyEnvironment (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter StgCreateStorageEx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetSidIdentifierAuthority (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter PnpIsFilePnpDriver (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DevRtlGetThreadLogToken (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FDICreate (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FDICopy (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FDIIsCabinet (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter FDIDestroy (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SfcIsKeyProtected (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter NotifyRedirectedStringChange (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoFreeUnusedLibraries (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00003280) "msiexec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00003280) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter EnableDebugLog (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter DpiContentScale (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter AI_ResolveKnownFolders (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter RestoreLocation (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005432) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter AI_ResolveKnownFolders (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005772) "MsiExec.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005772) "Updater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00003468) "Updater.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003468)31:T1444,"SELECT `Name`,`Event`,`ResetPeriod`,`RebootMessage`,`Command`,`Actions`,`DelayActions`,`Component_` FROM `AI_ServiceConfigFailureActions`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `name`,`event`,`resetperiod`,`rebootmessage`,`command`,`actions`,`delayactions`,`component_` from `ai_serviceconfigfailureactions`") "SELECT `Text` FROM `Control` WHERE `Control`.`Dialog_`='%s' AND `Control`.`Control`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `text` from `control` where `control`.`dialog_`='%s' and `control`.`control`='%s'") "INSERT INTO `" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "insert into `") "SELECT * FROM `%s` WHERE `Property`='%s' AND `Value`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `%s` where `property`='%s' and `value`='%s'") "SELECT * FROM `%s` WHERE `Property`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `%s` where `property`='%s'") "DELETE FROM `%s` WHERE `Property`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "delete from `%s` where `property`='%s'") "SELECT `Property` FROM `%s` WHERE `Property`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `property` from `%s` where `property`='%s'") "SELECT `Message` FROM `Error` WHERE `Error` = %s" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `message` from `error` where `error` = %s") "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `text` from `uitext` where `key` = '%s'") "SELECT `ActionProperty` FROM `Upgrade`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `actionproperty` from `upgrade`") "SELECT `Action`,`Target` FROM `CustomAction`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `action`,`target` from `customaction`") "DELETE FROM `Shortcut` WHERE `Shortcut`.`Directory_`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "delete from `shortcut` where `shortcut`.`directory_`='%s'") "DELETE FROM `IniFile` WHERE `IniFile`.`Section`='InternetShortcut' AND`IniFile`.`DirProperty`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "delete from `inifile` where `inifile`.`section`='internetshortcut' and`inifile`.`dirproperty`='%s'") "SELECT * FROM `%s`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `%s`") "SELECT `Component` FROM `Component`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `component` from `component`") "SELECT * FROM `Control` WHERE `Type` = 'Bitmap'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `control` where `type` = 'bitmap'") "SELECT * FROM `Control` WHERE `Type` = 'Icon'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `control` where `type` = 'icon'") "SELECT * FROM `Control` WHERE `Type` = 'PushButton'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `control` where `type` = 'pushbutton'") "SELECT `Argument`, `Condition` FROM `ControlEvent` WHERE `Dialog_` = 'ExitDialog' AND `Control_` = 'Finish' AND `Event` = 'DoAction' ORDER BY `Ordering`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `argument`, `condition` from `controlevent` where `dialog_` = 'exitdialog' and `control_` = 'finish' and `event` = 'doaction' order by `ordering`") "SELECT `Feature` FROM `Feature`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `feature` from `feature`") "SELECT `UserName` FROM `AI_UserAccounts` WHERE `UserName` = ?" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `username` from `ai_useraccounts` where `username` = ?") "SELECT `GroupName` FROM `AI_UserGroups` WHERE `GroupName` = ?" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `groupname` from `ai_usergroups` where `groupname` = ?") "SELECT `Cabinet` FROM `Media` WHERE `Media`.`Cabinet`='" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `cabinet` from `media` where `media`.`cabinet`='") "SELECT * FROM `Condition` WHERE `Condition`.`Feature_`='" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `condition` where `condition`.`feature_`='") "SELECT `Feature_`,`Level`,`Condition` FROM `Condition`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `feature_`,`level`,`condition` from `condition`")32:Td3b6,Found reference to API (Indicator: "FlsAlloc"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FlsFree"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FlsGetValue"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FlsSetValue"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LCMapStringEx"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LocaleNameToLCID"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "IsWow64Process"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetProcessId"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "Process32FirstW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "Process32NextW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SHGetMalloc"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ShellExecuteExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ShellExecuteW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "NetGetDCName"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "NetApiBufferFree"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "NetUserGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "NetQueryDisplayInformation"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "NetLocalGroupGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "NetGroupGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "NetUserModalsGet"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "PathFileExistsW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "HeapDestroy"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "HeapSize"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "HeapReAlloc"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "HeapFree"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "HeapAlloc"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetProcessHeap"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetProcAddress"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetModuleHandleW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetCurrentProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetLastError"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LocalAlloc"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LocalFree"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetTickCount"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "Sleep"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "EnterCriticalSection"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetCurrentProcessId"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetCurrentThreadId"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "OutputDebugStringW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SetFilePointer"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CreateFileW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "WriteFile"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FlushFileBuffers"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "DeleteFileW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CloseHandle"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SizeofResource"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LockResource"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LoadResource"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FindResourceW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FindResourceExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GlobalFindAtomW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GlobalAddAtomW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "lstrcpynW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "lstrcpyW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetTempPathW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ReadFile"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "MulDiv"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RaiseException"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "DecodePointer"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ExitProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "lstrlenW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LoadLibraryW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "lstrcmpW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetTempFileNameW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "DuplicateHandle"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetStdHandle"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CreateProcessW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "WaitForSingleObject"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetExitCodeProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetLocaleInfoW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "lstrcatW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RemoveDirectoryW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FindFirstFileW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FindNextFileW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "lstrcmpiW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FindClose"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "OpenMutexW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SetLastError"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FreeLibrary"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "OpenProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "TerminateProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SetEndOfFile"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "wsprintfW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CreateWindowExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RedrawWindow"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "EnumChildWindows"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "MessageBoxW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetForegroundWindow"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "EnumWindows"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "BringWindowToTop"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetDC"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetDesktopWindow"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetWindowTextW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "IsWindow"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "DeleteDC"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetDeviceCaps"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetOpenFileNameW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CloseServiceHandle"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "OpenSCManagerW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "QueryServiceStatus"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ControlService"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "StartServiceW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "OpenServiceW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RegCloseKey"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RegOpenKeyExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RegQueryValueExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "OpenProcessToken"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RegEnumValueW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RegCreateKeyExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RegSetValueExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LogonUserW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LookupAccountSidW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FreeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ConvertStringSidToSidW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetSidLengthRequired"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "InitializeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetSidSubAuthority"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "EnumServicesStatusW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LsaOpenPolicy"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LsaNtStatusToWinError"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LookupAccountNameW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LsaAddAccountRights"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LsaClose"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CoInitialize"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CoUninitialize"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CoTaskMemFree"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CoCreateInstance"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetStartupInfoW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "InitializeSListHead"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "RtlUnwind"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "InterlockedFlushSList"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "EncodePointer"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "TlsAlloc"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "TlsGetValue"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "TlsSetValue"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "TlsFree"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LoadLibraryExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetModuleFileNameA"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetACP"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetFileType"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "LCMapStringW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FindFirstFileExA"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FindNextFileA"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "IsValidCodePage"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetOEMCP"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetCPInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetCommandLineA"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetCommandLineW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetStringTypeW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SetStdHandle"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetConsoleCP"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "GetConsoleMode"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "SetFilePointerEx"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "WriteConsoleW"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "ServicesActive"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CancelWaitableTimer"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CreateWaitableTimerW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RegGetKeySecurity"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "TextOutA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestExA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "HttpEndRequestA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005772.00000000.232406.00110000.00000004.mdmp, 00000000-00005772.00000001.233993.00110000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00005772.00000001.233993.00110000.00000004.mdmp") Found reference to API (Indicator: "CoDisconnectObject"; Source: "00000000-00005772.00000001.233993.00110000.00000004.mdmp")33:T10ef,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") file/memory contains long string with (Indicator: "GetLastError"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetLastError API returned:" (Indicator: "GetLastError"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "Could not remove directory: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error getting file attributes. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error setting file attributes. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error opening file for read: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Failed to create [2] textstyle. GetLastError() returned: [3]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error getting disk free space. GetLastError: [2]. Volume: [3]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error creating temp file on path: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Could not update resource for file: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error getting file security: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error waiting for patch thread. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error setting file attribute: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error determining whether file is in-use: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Could not create thread for patch application. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error converting file time to local time for file: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Patch file [2] is corrupt or of an invalid format. Attempting to patch file [3]. GetLastError: [4]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Could not get file time for file: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error getting file attributes: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Could not set file time for file: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Could not apply patch to file [2]. GetLastError: [3]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "Error opening file for write: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp")34:Taa9,"tallCustomSetupIconcusticonDefaultUIFontDlgFont8DlgTitleFont{\DlgFontBold8}ExclamationIconexclamicInfoIconinfoInstallerIconinsticonRemoveIconremovicoRepairIconrepairicUpDirIconUpNewDirIconNewAI_CF_TITLE_TEXT_STYLE{\CfTitleFont}BannerBitmapbannerAI_ThemeStyleaeroAI_FrameColorsteelblueAI_LOG_CHECKBOXAiStyleConditions TabBackgroundtabbackAI_BUILD_NAMEDefaultBuildAI_PACKAGE_TYPEIntelAI_BOOTSTRAPPER_CHECK_LCAI_BOOTSTRAPPERLANGS1033;AI_BOOTSTRAPPERORIGINALLANGDirectoryDirectory_ParentDefaultDirTARGETDIRSourceDirAPPDIR:.ProgramMenuFolderCELAST~1|CelasTradeProPLATFO~1|platformsDesktopFolderDESKTO~1|DesktopFolderPROGRA~1|ProgramMenuFolderFeatureFeature_ParentTitleDescriptionDisplayLevelMainFeatureFeatureComponentsFeature_Component_FileFileNameFileSizeLanguageQT5WID~1.DLL|Qt5Widgets.dll5.2.1.0QT5SCR~1.DLL|Qt5Script.dllCELAST~1.EXE|CelasTradePro.exe1.0.0.01.0.2.15QT5NET~1.DLL|Qt5Network.dll10.0.40219.3251.2.11.0RegistryRootKeyPathSoftware\[Manufacturer]\[ProductName][APPDIR][ProductVersion]ShortcutTargetArgumentsHotkeyI" in Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652 "Software\Microsoft\Windows NT\CurrentVersion" in Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652 "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652 "Software\Caphyon\Advanced Installer" in Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652 "Software\Caphyon\Advanced Installer\Installation Path" in Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652 "SOFTWARE\Microsoft\InetStp" in Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652 "Software\Policies\Microsoft\Windows\Installer" in Source: 54606-18-004CB385 "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00003280.00000002.231507.00280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00003280.00000002.231507.004C1000.00000020.mdmp "Software\[Manufacturer]\[ProductName]" in Source: 00000000-00003280.00000002.231507.013F0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003468.00000000.234247.002F0000.00000004.mdmp 00000000-00003468.00000001.235257.002F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003468.00000000.234247.002F0000.00000004.mdmp 00000000-00003468.00000001.235257.002F0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005432.00000000.228329.7F6F0000.00000002.mdmp35:Tb4f,"" (Indicator: ".ost") in Source: 00000000-00003280.00000002.231507.00280000.00000004.mdmp36:T3076,"msiexec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70e00000 "msiexec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "msiexec.exe" loaded module "KERNEL32" at base 75610000 "msiexec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "msiexec.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a910000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75610000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74040000 "msiexec.exe" loaded module "DWMAPI.DLL" at base 73da0000 "msiexec.exe" loaded module "COMCTL32.DLL" at base 740b0000 "msiexec.exe" loaded module "UXTHEME.DLL" at base 74040000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75c20000 "msiexec.exe" loaded module "CRYPTBASE.DLL" at base 750e0000 "msiexec.exe" loaded module "CLBCATQ.DLL" at base 75dd0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76320000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76450000 "msiexec.exe" loaded module "OLE32.DLL" at base 75c20000 "msiexec.exe" loaded module "ADVAPI32.DLL" at base 75520000 "msiexec.exe" loaded module "PROPSYS.DLL" at base 73c80000 "msiexec.exe" loaded module "OLEAUT32.DLL" at base 760a0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 73d80000 "msiexec.exe" loaded module "RPCRT4.DLL" at base 76240000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75520000 "msiexec.exe" loaded module "WINTRUST.DLL" at base 75350000 "msiexec.exe" loaded module "CRYPTSP.DLL" at base 74bf0000 "msiexec.exe" loaded module "MSISIP.DLL" at base 71220000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75220000 "msiexec.exe" loaded module "USER32.DLL" at base 77430000 "msiexec.exe" loaded module "NCRYPT.DLL" at base 74d20000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 748c0000 "msiexec.exe" loaded module "CRYPT32.DLL" at base 75220000 "msiexec.exe" loaded module "USERENV.DLL" at base 75470000 "msiexec.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75c00000 "msiexec.exe" loaded module "GPAPI.DLL" at base 747c0000 "msiexec.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75c00000 "msiexec.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75c00000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 711e0000 "msiexec.exe" loaded module "CRYPTNET.DLL" at base 711e0000 "msiexec.exe" loaded module "SENSAPI.DLL" at base 72620000 "msiexec.exe" loaded module "SHLWAPI.DLL" at base 763f0000 "msiexec.exe" loaded module "WINHTTP.DLL" at base 71160000 "msiexec.exe" loaded module "WS2_32.DLL" at base 755d0000 "msiexec.exe" loaded module "KERNEL32.DLL" at base 75610000 "msiexec.exe" loaded module "SSPICLI.DLL" at base 75070000 "msiexec.exe" loaded module "CREDSSP.DLL" at base 748b0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74bb0000 "msiexec.exe" loaded module "WSHTCPIP" at base 74710000 "msiexec.exe" loaded module "WSHIP6.DLL" at base 74ba0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71990000 "msiexec.exe" loaded module "IPHLPAPI.DLL" at base 73550000 "msiexec.exe" loaded module "DHCPCSVC6.DLL" at base 73450000 "msiexec.exe" loaded module "DHCPCSVC.DLL" at base 73370000 "msiexec.exe" loaded module "NTDLL.DLL" at base 772e0000 "msiexec.exe" loaded module "NSI.DLL" at base 76000000 "msiexec.exe" loaded module "CFGMGR32.DLL" at base 754e0000 "msiexec.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75c00000 "msiexec.exe" loaded module "PROFAPI.DLL" at base 751f0000 "msiexec.exe" loaded module "DNSAPI.DLL" at base 74a70000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74710000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74ba0000 "msiexec.exe" loaded module "RASADHLP.DLL" at base 71930000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 734c0000 "msiexec.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75c00000 "msiexec.exe" loaded module "SETUPAPI.DLL" at base 75e60000 "msiexec.exe" loaded module "CABINET.DLL" at base 70790000 "msiexec.exe" loaded module "DEVRTL.DLL" at base 74960000 "msiexec.exe" loaded module "RPCRTREMOTE.DLL" at base 75180000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 6d6b0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75090000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74680000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 69fc0000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 69f30000 "msiexec.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "msiexec.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "msiexec.exe" loaded module "VERSION.DLL" at base 74680000 "msiexec.exe" loaded module "MSIHND.DLL" at base 69ed0000 "msiexec.exe" loaded module "DWMAPI" at base 73da0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\USER32.DLL" at base 77430000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RPCRT4.DLL" at base 76240000 "msiexec.exe" loaded module "USER32" at base 77430000 "msiexec.exe" loaded module "RICHED20.DLL" at base 699a0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74980000 "msiexec.exe" loaded module "MSI.DLL" at base 6d6b0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 763f0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\TSAPPCMP.DLL" at base 0 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 75470000 "msiexec.exe" loaded module "COMCTL32" at base 740b0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SRCLIENT.DLL" at base 725e0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SPP.DLL" at base 6d410000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\VSS_PS.DLL" at base 72890000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\VSSAPI.DLL" at base 70fe0000 "msiexec.exe" loaded module "DSROLE.DLL" at base 73600000 "msiexec.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75610000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 71ec0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\ES.DLL" at base 735a0000 "msiexec.exe" loaded module "SXS.DLL" at base 750f0000 "msiexec.exe" loaded module "OLEAUT32" at base 760a0000 "msiexec.exe" loaded module "SAMCLI.DLL" at base 731b0000 "msiexec.exe" loaded module "SAMLIB.DLL" at base 73e30000 "msiexec.exe" loaded module "NETUTILS.DLL" at base 74030000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 760a0000 "msiexec.exe" loaded module "MSISIP.DLL" at base 72630000 "msiexec.exe" loaded module "WINSTA.DLL" at base 75150000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 69950000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 698c0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 6ca20000 "msiexec.exe" loaded module "NTMARTA.DLL" at base 74650000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 772e0000 "msiexec.exe" loaded module "SHELL32.DLL" at base 76450000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 71250000 "msiexec.exe" loaded module "CABINET" at base 70790000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c80000 "msiexec.exe" loaded module "LINKINFO.DLL" at base 6e200000 "msiexec.exe" loaded module "NTSHRUI.DLL" at base 72020000 "msiexec.exe" loaded module "SRVCLI.DLL" at base 74de0000 "msiexec.exe" loaded module "CSCAPI.DLL" at base 6fc50000 "msiexec.exe" loaded module "SLC.DLL" at base 73590000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNELBASE.DLL" at base 75420000 "MsiExec.exe" loaded module "CRYPTSP.DLL" at base 74bf0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74980000 "MsiExec.exe" loaded module "ADVAPI32.DLL" at base 75520000 "MsiExec.exe" loaded module "CRYPTBASE.DLL" at base 750e0000 "MsiExec.exe" loaded module "RPCRTREMOTE.DLL" at base 75180000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 6d6b0000 "MsiExec.exe" loaded module "MSI.DLL" at base 6d6b0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75c20000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\RPCRT4.DLL" at base 76240000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75520000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70e00000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "MsiExec.exe" loaded module "KERNEL32" at base 75610000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "MsiExec.exe" loaded module "%TEMP%\MSI44CF.TMP" at base 6c240000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\USER32.DLL" at base 77430000 "MsiExec.exe" loaded module "%TEMP%\MSI5959.TMP" at base 6c240000 "MsiExec.exe" loaded module "%TEMP%\MSI60D9.TMP" at base 6c240000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74040000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76450000 "MsiExec.exe" loaded module "OLE32.DLL" at base 75c20000 "MsiExec.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75c00000 "MsiExec.exe" loaded module "PROFAPI.DLL" at base 751f0000 "MsiExec.exe" loaded module "OLEAUT32.DLL" at base 760a0000 "MsiExec.exe" loaded module "%TEMP%\MSI6B17.TMP" at base 6c240000 "MsiExec.exe" loaded module "RPCRT4.DLL" at base 76240000 "MsiExec.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75c00000 "MsiExec.exe" loaded module "CLBCATQ.DLL" at base 75dd0000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSI3D3F.TMP" at base 6c240000 "Updater.exe" loaded module "SECUR32.DLL" at base 74f10000 "Updater.exe" loaded module "RPCRT4.DLL" at base 76240000 "Updater.exe" loaded module "SHELL32.DLL" at base 76450000 "Updater.exe" loaded module "OLE32.DLL" at base 75c20000 "Updater.exe" loaded module "ADVAPI32.DLL" at base 75520000 "Updater.exe" loaded module "KERNEL32.DLL" at base 75610000 "Updater.exe" loaded module "PROFAPI.DLL" at base 751f0000 "Updater.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 704a0000 "Updater.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 754c0000 "Updater.exe" loaded module "WS2_32.DLL" at base 755d0000 "Updater.exe" loaded module "WINHTTP.DLL" at base 71160000 "Updater.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74bb0000 "Updater.exe" loaded module "CRYPT32.DLL" at base 75220000 "Updater.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74ba0000 "Updater.exe" loaded module "IPHLPAPI.DLL" at base 73550000 "Updater.exe" loaded module "USERENV.DLL" at base 75470000 "Updater.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75c00000 "Updater.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 729a0000 "Updater.exe" loaded module "DNSAPI.DLL" at base 74a70000 "Updater.exe" loaded module "CRYPTBASE.DLL" at base 750e0000 "Updater.exe" loaded module "CLBCATQ.DLL" at base 75dd0000 "Updater.exe" loaded module "DHCPCSVC6.DLL" at base 73450000 "Updater.exe" loaded module "DHCPCSVC.DLL" at base 73370000 "Updater.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6cf80000 "Updater.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74710000 "Updater.exe" loaded module "RASADHLP.DLL" at base 71930000 "Updater.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75c00000 "Updater.exe" loaded module "URLMON.DLL" at base 759f0000 "Updater.exe" loaded module "CRYPTSP.DLL" at base 74bf0000 "Updater.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74980000 "Updater.exe" loaded module "RPCRTREMOTE.DLL" at base 75180000 "Updater.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6cf60000 "Updater.exe" loaded module "OLEAUT32.DLL" at base 760a0000 "Updater.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 760a0000 "Updater.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 756f000037:T579,"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652" was detected as "Microsoft Compound" and name: "Archive" "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652" was detected as "Microsoft Compound" and name: "Data" "libeay32.dll" was detected as "Microsoft Compound" and name: "Archive" "libeay32.dll" was detected as "Microsoft Compound" and name: "Data" "Qt5Script.dll" was detected as "Microsoft Compound" and name: "Archive" "Qt5Script.dll" was detected as "Microsoft Compound" and name: "Data" "qwindows.dll" was detected as "Microsoft Compound" and name: "Archive" "qwindows.dll" was detected as "Microsoft Compound" and name: "Data" "Qt5Network.dll" was detected as "Microsoft Compound" and name: "Archive" "Qt5Network.dll" was detected as "Microsoft Compound" and name: "Data" "ssleay32.dll" was detected as "Microsoft Compound" and name: "Archive" "ssleay32.dll" was detected as "Microsoft Compound" and name: "Data" "Updater.exe" was detected as "Microsoft Compound" and name: "Archive" "Updater.exe" was detected as "Microsoft Compound" and name: "Data" "zlib.dll" was detected as "Microsoft Compound" and name: "Archive" "zlib.dll" was detected as "Microsoft Compound" and name: "Data" "MSI60D9.tmp" was detected as "Microsoft Compound" and name: "Archive" "MSI60D9.tmp" was detected as "Microsoft Compound" and name: "Data"38:T1444,"SELECT `Name`,`Event`,`ResetPeriod`,`RebootMessage`,`Command`,`Actions`,`DelayActions`,`Component_` FROM `AI_ServiceConfigFailureActions`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `name`,`event`,`resetperiod`,`rebootmessage`,`command`,`actions`,`delayactions`,`component_` from `ai_serviceconfigfailureactions`") "SELECT `Text` FROM `Control` WHERE `Control`.`Dialog_`='%s' AND `Control`.`Control`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `text` from `control` where `control`.`dialog_`='%s' and `control`.`control`='%s'") "INSERT INTO `" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "insert into `") "SELECT * FROM `%s` WHERE `Property`='%s' AND `Value`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `%s` where `property`='%s' and `value`='%s'") "SELECT * FROM `%s` WHERE `Property`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `%s` where `property`='%s'") "DELETE FROM `%s` WHERE `Property`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "delete from `%s` where `property`='%s'") "SELECT `Property` FROM `%s` WHERE `Property`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `property` from `%s` where `property`='%s'") "SELECT `Message` FROM `Error` WHERE `Error` = %s" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `message` from `error` where `error` = %s") "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `text` from `uitext` where `key` = '%s'") "SELECT `ActionProperty` FROM `Upgrade`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `actionproperty` from `upgrade`") "SELECT `Action`,`Target` FROM `CustomAction`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `action`,`target` from `customaction`") "DELETE FROM `Shortcut` WHERE `Shortcut`.`Directory_`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "delete from `shortcut` where `shortcut`.`directory_`='%s'") "DELETE FROM `IniFile` WHERE `IniFile`.`Section`='InternetShortcut' AND`IniFile`.`DirProperty`='%s'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "delete from `inifile` where `inifile`.`section`='internetshortcut' and`inifile`.`dirproperty`='%s'") "SELECT * FROM `%s`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `%s`") "SELECT `Component` FROM `Component`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `component` from `component`") "SELECT * FROM `Control` WHERE `Type` = 'Bitmap'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `control` where `type` = 'bitmap'") "SELECT * FROM `Control` WHERE `Type` = 'Icon'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `control` where `type` = 'icon'") "SELECT * FROM `Control` WHERE `Type` = 'PushButton'" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `control` where `type` = 'pushbutton'") "SELECT `Argument`, `Condition` FROM `ControlEvent` WHERE `Dialog_` = 'ExitDialog' AND `Control_` = 'Finish' AND `Event` = 'DoAction' ORDER BY `Ordering`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `argument`, `condition` from `controlevent` where `dialog_` = 'exitdialog' and `control_` = 'finish' and `event` = 'doaction' order by `ordering`") "SELECT `Feature` FROM `Feature`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `feature` from `feature`") "SELECT `UserName` FROM `AI_UserAccounts` WHERE `UserName` = ?" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `username` from `ai_useraccounts` where `username` = ?") "SELECT `GroupName` FROM `AI_UserGroups` WHERE `GroupName` = ?" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `groupname` from `ai_usergroups` where `groupname` = ?") "SELECT `Cabinet` FROM `Media` WHERE `Media`.`Cabinet`='" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `cabinet` from `media` where `media`.`cabinet`='") "SELECT * FROM `Condition` WHERE `Condition`.`Feature_`='" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select * from `condition` where `condition`.`feature_`='") "SELECT `Feature_`,`Level`,`Condition` FROM `Condition`" (Source: 6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652, Indicator: "select `feature_`,`level`,`condition` from `condition`")39:Tb8b,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005772.0000168C.73845891.00050000.wprm] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00001200-00000C25-2540092215] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001200-00000C25-2540407127] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00001200-00000C25-2541551026] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00001200-00000C25-2541830024] Observed system executable string:"%WINDIR%\system32\SHELL32.DLL" [Source: 00000000-00001200-00000C25-2541985091] Observed system executable string:"%WINDIR%\system32\NETAPI32.DLL" [Source: 00000000-00001200-00000C25-2542729457] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00001200-00000C25-2543071355] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00001200-00000C25-2544084819] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00001200-00000C25-2545281948] Observed system executable string:"%WINDIR%\System32\cryptnet.dll" [Source: 00000000-00001200-00000C25-2546604767] Observed system executable string:"%WINDIR%\system32\APPHELP.DLL" [Source: 00000000-00001200-00000C25-2568462447] Observed system executable string:"%WINDIR%\system32\VERSION.DLL" [Source: 00000000-00001200-00000C25-2568682107] Observed system executable string:"%WINDIR%\system32\sxs.DLL" [Source: 00000000-00001200-00000C25-2568887556] Observed system executable string:"%WINDIR%\system32\MSCOREE.DLL" [Source: 00000000-00001200-00000C25-2569472227] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001200-00000C25-2571250418] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001200-00000C25-2571930760] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\fusion.dll" [Source: 00000000-00001200-00000C25-2572259463] Observed system executable string:"%WINDIR%\system32\USER32.DLL" [Source: 00000000-00001200-00000C25-2578110329] Observed system executable string:"%WINDIR%\system32\RPCRT4.DLL" [Source: 00000000-00001200-00000C25-2580490755] Observed system executable string:"%WINDIR%\system32\OLE32.DLL" [Source: 00000000-00003280-00000C25-2575477367] Observed system executable string:"%WINDIR%\system32\SHLWAPI.DLL" [Source: 00000000-00003280-00000C25-2575691075] Observed system executable string:"%WINDIR%\system32\TSAPPCMP.DLL" [Source: 00000000-00003280-00000C25-2608933357] Observed system executable string:"%WINDIR%\system32\USERENV.DLL" [Source: 00000000-00003280-00000C25-2609269515] Observed system executable string:"%WINDIR%\system32\SRCLIENT.DLL" [Source: 00000000-00003280-00000C25-2610878022]3a:Te24,"Qt5Core.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Qt5Widgets.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Qt5Gui.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "CelasTradePro.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: N/A] "Qt5Script.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "qwindows.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Qt5Network.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: N/A] "Updater.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "zlib.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: N/A] "CelasTradePro.exe" has type "MS Windows icon resource - 6 icons 256x256 with PNG image data 256 x 256 8-bit/color RGBA non-interlaced 32 bits/pixel -128x-128 32 bits/pixel"- [targetUID: N/A] "CelasTradePro.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Archive ctime=Fri Jul 13 04:08:02 2018 mtime=Wed Jul 17 21:54:29 2024 atime=Fri Jul 13 04:08:02 2018 length=2517160 window=hide"- [targetUID: N/A] "MSI60D9.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "TarF7A8.tmp" has type "data"- [targetUID: N/A] "MSI9A2E.tmp" has type "data"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 71954 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "36ded51b.rbs" has type "data"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- [targetUID: N/A] "5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7" has type "data"- [targetUID: N/A] "D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_95A70FB26B8DB52F768F06E2EF1BC5E9" has type "data"- [targetUID: N/A] "F234AF16A662E2448E049CAD14C6D675" has type "data"- [targetUID: N/A] "EE44ECA143B76F2B9F2A5AA75B5D1EC6_5BFB72FAE1BB9D1928D1C5C92F52E8EA" has type "data"- [targetUID: N/A] "0F7788E201A03EF5036E7C8BF55432CB_BDA62707BA70CB0111D9E81215C5BF30" has type "data"- [targetUID: N/A] "5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" has type "data"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- [targetUID: N/A] "0A47A12B5C7E1616F4B3AE939D5DF475" has type "data"- [targetUID: N/A] "MSI44CF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI3D3F.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI5959.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI6B17.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "CabF7A7.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 71954 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A]3b:Ta57,"msiexec.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "msiexec.exe" monitors "HKLM\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "msiexec.exe" monitors "HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0)3c:T5e4,"Updater.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "Updater.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "")3d:T7eb,"Updater.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3e:T6f0,"msiexec.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\msi.dll" "msiexec.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "msiexec.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "msiexec.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\SspiCli.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\WINSPOOL.DRV" "msiexec.exe" trying to touch file "C:\Windows\System32\MPR.dll" "msiexec.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\UxTheme.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\WINMM.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\samcli.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\MSACM32.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\VERSION.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\sfc.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\sfc_os.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\dwmapi.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\msiexec.exe.Config" "msiexec.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\msiexec.exe.Local\" "msiexec.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "msiexec.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.DLL" "msiexec.exe" trying to touch file "C:\Windows\system32\TSAPPCMP.DLL"3f:T693,"msiexec.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "msiexec.exe" touched file "C:\Windows\AppPatch\msimain.sdb" "msiexec.exe" touched file "C:\Windows\system32\ar-SA\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\bg-BG\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\cs-CZ\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\da-DK\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\de-DE\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\el-GR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\en\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\es-ES\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\et-EE\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\fi-FI\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\fr-FR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\he-IL\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\hr-HR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\hu-HU\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\it-IT\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\ja-JP\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\ko-KR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\lt-LT\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\lv-LV\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\nb-NO\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\nl-NL\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\pl-PL\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\pt-BR\sxs.DLL.mui"40:T423,"msiexec.exe" trying to access non-existent file "C:\Windows\system32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll"41:T877,"msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3a4fb8" "lpszHeaders": "If-None-Match: \"084627641cfd61:0\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT" "dwHeadersLength": "4294967295" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3b2c48" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3b2628" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39b638" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2499090" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "43ff0f0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4406c10" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3b2cb0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "256ec30" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4410a20" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "14c01b0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2bccb8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}42:T4f0,"msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "3a4fb8" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "3b2c48" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "3b2628" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "39b638" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2499090" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "43ff0f0" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "4406c10" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "3b2cb0" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "256ec30" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "4410a20" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "14c01b0" "lpReserved": "0"} "msiexec.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2bccb8" "lpReserved": "0"}43:T835,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001200-00000C26-2549995043") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001200-00000C26-2551495881") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00001200-00000C26-2551862347") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001200-00000C26-2551862347") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001200-00000C26-2551862347") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00001200-00000C26-2554125741") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001200-00000C26-2554125741") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001200-00000C26-2554304626") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001200-00000C26-2554305577") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00001200-00000C26-2554317641") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001200-00000C26-2554318289") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found reference to API "49324349926,4076,3200,,HttpOpenRequestA,Wininet.dll,"254:44:43.370",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00003468.00000001.235257.002F0000.00000004.mdmp") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp")44:T624,Found reference to API "NetGetDCName" (Indicator: "NetGetDCName"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetQueryDisplayInformation" (Indicator: "NetQueryDisplayInformation"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetLocalGroupGetInfo" (Indicator: "NetLocalGroupGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetGroupGetInfo" (Indicator: "NetGroupGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetUserModalsGet" (Indicator: "NetUserModalsGet"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "::NetGetDCName failed. Error:" (Indicator: "NetGetDCName"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetUserGetInfo failed. Error:" (Indicator: "NetUserGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetUserModalsGet will use empty target computer name." (Indicator: "NetUserModalsGet"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetUserModalsGet failed with:" (Indicator: "NetUserModalsGet"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652")45:T1fe2,Found string "!This program cannot be run in DOS mode.g;OV#Z!Rich#Z!P%d[.text`.rdata@.data.rsrc@.relocSVWPdkernel32advapi32winiLoadLibraryAGetProcAddrefCreateToolhelp32SnapshotProcess32FirfProcess32NexfCloseHanGetComputerNameAGetComputerNameWSleefRegOpenKeyExfRegOpenKeyExfRegQueryValueExARegQueryValueExWInternetOpenfInternetConnectAInternetCloseHanHttpOpenRequestAInternetQueryDataAvailabfInternetReadFileSVWPdkernel32LoadLibraryAGetProcAddrefFreeLibrLocalAllfLocalFref=t ARPQW[System Process]Systf=| A=t ASOFTWARE\\Microsoft\\Windows NT\\CurrentVersProductNCurrentBuildNumbfReleaseIfBuildBra=| A=t A=| At&;]=| A=| Ahttphttps://=t A=| AAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, Accept:text/html, application/xhtml+xml, */*User-Agent: HostfConnection:Keep-AlivAccept-Encoding:gzip, deflatContent-type: multipart/form-data;boundary=jContnt-lngthfPOSTHTTP/1.1=| A=| AChecD$ kUpdD$$ate=| AD$thttpD$xs://D$|www.lasllc.com/cckupf.phpD$HjD$Jus--fContnt-Disposition: form-data; nf="api"; t_configContnt-Disposition: form-data; nf="upload"; ff="%snt-Tf: apD$\Pplication/oct-stD$dtD$fmp.gfD$jifD$@P=t A=| AL$@QVjD$8tL$ hD$`PD$lMAX_D$pPATHD$XjD$ZusDT$LR=t AD$ 200D$(300=| A_^[30123456789abcdef=t ARSShSRVP=| At6;u=t/A=4"A=8"A=<"ASQRPj=8"A=<"A=0"A=0"A=8"A9H8tC Qh=8"APSQRF$@t=0"A=0"A=t/A=x/A=x/Atd9u=<"A=t/A=8"A=0"A=0"AF(QRV,PQV,QW=8"A=0"A=8"Au!Pjt0j@j=0"AF `Q@A4+C4u=0"Au#hZ=8"AtRW3F,QRV4Rh5x%AwoVW=x%A5x%A^[_3 SW35x%A=H"AYQPVh5H#A=D#A%8#A-4#A5t%APPPPPuTVWhBPPPPP"u&< tK?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~GetProcessWindowStationGetUserObjectInformationWGetLastActivePopupGetActiveWindowMessageBoxW Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__eabi__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based( !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~Error protecting memory page%02x%s%d%09d-%05d--jeus--Kernel32.dllKernel32.dllRSDSVTH:\DEV\TManager\DLoader\20180702\dloader\WorkingDir\Output\00000009\Release\dloader.pdbLoadLibraryAGetTickCountGetCommandLineAWideCharToMultiByteGetLastErrorGetLocalTimeGetNativeSystemInfoHeapAllocHeapFreeVirtualFreeGetProcessHeapIsBadReadPtrFileTimeToSystemTimeSetLastErrorVirtualAllocGetModuleHandleAVirtualProtectKERNEL32.dllReleaseDCGetDCDrawTextAScreenToClientCreateWindowExAGetWindowLongAInvalidateRectFillRectDestroyWindowUSER32.dllCreateFontATextOutACreateSolidBrushCreateCompatibleDCPolygonDeleteDCGDI32.dllCryptGetHashParamCryptReleaseContextCryptAcquireContextACryptCreateHashCryptDestroyHashCryptHashDataADVAPI32.dllHttpSendRequestExAInternetSetOptionAInternetWriteFileHttpEndRequestAWININET.dllCryptStringToBinaryACRYPT32.dllEncodePointerDecodePointerGetSystemTimeAsFileTimeMultiByteToWideCharHeapReAllocHeapSetInformationGetStartupInfoWTerminateProcessGetCurrentProcessUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentHeapCreateGetProcAddressGetModuleHandleWExitProcessWriteFileGetStdHandleGetModuleFileNameWSleepHeapSizeTlsAllocTlsGetValueTlsSetValueTlsFreeInterlockedIncrementGetCurrentThreadIdInterlockedDecrementGetCPInfoGetACPGetOEMCPIsValidCodePageGetModuleFileNameAFreeEnvironmentStringsWGetEnvironmentStringsWSetHandleCountInitializeCriticalSectionAndSpinCountGetFileTypeDeleteCriticalSectionQueryPerformanceCounterGetCurrentProcessIdSetFilePointerGetConsoleCPGetConsoleModeEnterCriticalSectionLeaveCriticalSectionLoadLibraryWRtlUnwindIsProcessorFeaturePresentLCMapStringWGetStringTypeWSetStdHandleWriteConsoleWCreateFileWCloseHandleFlushFileBuffers.?AVtype_info@@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.?AVPOLY_CArc_20180702_152654_0181C1D0_73B9@@.?AVPOLY_CDrawText_20180702_152654_0181C1D0_4ACC@@.?AVPOLY_CGetLocalTime_20180702_152654_0181C1D0_5AF6@@.?AVPOLY_CCreateFont_20180702_152654_0181C1D0_32C7@@.?AVPOLY_CScreenToClient_20180702_152654_0181C1D0_4C3D@@Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)GIF89aMoz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd.?AVPOLY_CTextOut_20180702_152654_0181C1EF_160E@@.?AVPOLY_CWnd_20180702_152654_0181C1EF_0969@@.?AVPOLY_CCreateFont_20180702_152654_0181C1EF_2711@@.?AVPOLY_CFillRect_20180702_152654_0181C1DF_360B@@.?AVPOLY_CInvalidateRect_20180702_152654_0181C1DF_2720@@.?AVPOLY_CDC_20180702_152654_0181C1DF_5623@@.?AVPOLY_CPolygon_20180702_152654_0181C1DF_3484@@IHDRIDATxc7m#oBhgrLh*}Zh'm+67rXuM'k>1YDV)@RM^,Y5_=7PZ0Atk'U@w&z{sRMGV)oe`+IWMQU)Nx)?M)wRMSq@m']lO{=Km;p4!3ZQAmg>d"%koVv_SIyJ'~#:lrj/CVco0&FN#:;%(a[`A]7DRMDLkVBgq~](,_h%Zp)pO((I5=doEoCMBWIUbm={b16ar(*1V1V%q=YTyU1\%B;[d}1V%!nI55#&ssMGqp$g\8v*d%eRMUu#a1\ef/F&'B6aKc[v]*C~GhB;AN\{IhSh7b|Sh{&FNPJ?Y&?dO"LQOm3~wSYbNtZkFRM7aI5]M"}RhY=Ez$63M696N*T)t{1To9/E/=* PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD525A5V5m5w56!6U6[6g7:8D8Y8p89c9n99B:I:Z:;.;W;_;z;>$>]>0*0u0091M1X13*3A3W3m3y33 4W4b4|44P5j56R6`6o6(7378#9999!;];<;=e=w=>D>K>[>~>>!?0?`?q?20A00K1U1g12%2/2B6627@7O7e7r77848;J;Z;i;=6=@=M=W=o==$>b>h>r>?%?2?b0h0u02 2G2Q2q2293n33I4m46)626:6n67&7-7Q78&8n8t8979i9u9:=:g:;o;z;;k->T>`>p>?5?]?m?0Q0e01U1q17"7Q7W7f7@8G8O899 9<&=.=C=N=>7>\>k>s>0$0+030;0C0O0X0]0c0m0v01C2U253?3L33 434j4v440585K5V5[5m5w5|56P6Z68&8,8:8n8{88*9X9:2;;;G;=n= >7(:,:0:4:8:<:@:D:L:S:_:e:q:w:!>)>.>6>;>B>Q>V>\>e>0=0D0H0L0P0T0X0\0`00"1-1H1O1T1X1\1}11F2L2P2T2X24>6O67#7-7@7d77S8p88(9G9:/:H:d:m:s:|:=>Y?_?1 1X1b13*404L4t4616O6s67 7%7F7K7q78O8\8u8=f>6?g?}?2'232C2J2Y2e2r22.3=3F3j36/6F6T6Z6}68$8S8Y8a89s9|9< <)<3<>>?_?h?1!2-22+31363<3M3364`46B6j6F7V7f7q78!818A8R8V8b8f8l89&9 9B9F9T9X9]9b9g9l92L2P2T2X2<$< <084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|89 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|94$44484H4L4T4l4|45 5$5,5D5T5X5h5l5t56,606@6D6L6d6t6x67$7<7x78(8H8h89(9D9H9h90$0(07 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|78 8$8(8,80848889 9h9p9<8=<=@=D=H=L=P=T=X=\=h=l=p=t=x=|=0,0@0H0\0d0081x1"; File: "Updater.exe")46:T2317,Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://ns.adobe.com/xap/1.0/" Heuristic match: "> 9iqmgvw,czcrisign" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,western" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0j24y" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "https://www.digicert.com/cps0azm$v0t082http://crl3.digicert.com/digicertassuredidca-1.crl082http://crl4.digicert.com/digicertassuredidca-1.crl0wk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicertassuredidca-1.crt0iw!]4/(o:r" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crleotrustcalrpccalrpcsmapicalrpcsmapicalrpcsmapidigestigicert" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbr8swzunkvbro5ijhat9gv793rvlaqurb2yejs0jvf6xczu7wo94ctlvbocecdm7lbrsfooq9dwovye3ii%3d5457a8ce4b2a7499f8299a013b6e1c7c_http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbr8swzunkvbro5ijhat9gv793rvlaqurb2yejs0jvf6xczu7wo94ctlvbocecdm7lbrsfooq9dwovye3ii%3dnewdiriconbannerbitmapsteelbluedefaultbuilddirectorydefaultdirtargetdirsourcedirdescriptionmainfeaturecomponent_argumentsiconindexversionminversionmaxoldproductsprogressdlgai_set_adminexitdialogpreparedlgen-usthe" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0mc50mc5-mc580a0" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n;8kb%2+joonsidere+g!!0ik)$bf!internet1verisign," - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?l5mal5igl5ihxx4bl5&\l5&d%" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/pro230918200108z0/^g(o-cejy" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0c500eotrusoc5ob$qp,gx?_sectigo" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crlhttp://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbr8swzunkvbro5ijhat9gv793rvlaqurb2yejs0jvf6xczu7wo94ctlvbocecdm7lbrsfooq9dwovye3ii%3da513sessacceptacceptemgrtimremgrtimrcojrdnsctimr@@qsx@aes" - Source: "00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found URL "https://accept:" - Source: "00000000-00003468.00000000.234247.01161000.00000020.mdmp")48:T858,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBReA" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base62 string in header "2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8w" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSd" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base62 string in header "2FnmS71JzhICEQCac1ULg3aGO9lDD6qLW" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3x" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFD" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "xAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"49:T1497,Found string "+ncalrpc:[OLE7FE66302541B44C8A41226835BE5]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "+ncalrpc:[OLE51916091907C455C8E6BFCF77F8C]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "+ncalrpc:[OLE51FBD149AB5746C181A14F80BCF9]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "A+ncalrpc:[OLE51FBD149AB5746C181A14F80BCF9]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000001.229584.00280000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "B+ncalrpc:[OLE24AB348B1F1443B59311988D7091]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "+ncalrpc:[OLE24AB348B1F1443B59311988D7091]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "+ncalrpc:[OLE27618FCF6EFF4FA3B40A25C3335B]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "+ncalrpc:[OLE6BE413928D054FCF87BCAA820EB9]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "+ncalrpc:[OLEF72E328FA1974B8EA4E1B2B6A829]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "+ncalrpc:[OLEB62F4BB33F374A849B43E9E172FF]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "I+ncalrpc:[OLEF72E328FA1974B8EA4E1B2B6A829]" (Indicator: "ncalrpc"; Source: "00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp") Found string "+ncalrpc:[OLEE6B3170E471548E7B217163BF8C0]" (Indicator: "ncalrpc"; Source: "00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp") Found string "+ncalrpc:[OLEF72E328FA1974B8EA4E1B2B6A829]" (Indicator: "ncalrpc"; Source: "00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp") Found string "+ncalrpc:[OLE1B9EBE77FD4442509C6C758796DC]" (Indicator: "ncalrpc"; Source: "00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp") Found string "B+ncalrpc:[OLE7FE66302541B44C8A41226835BE5]" (Indicator: "ncalrpc"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string "+ncalrpc:[OLE51FBD149AB5746C181A14F80BCF9]" (Indicator: "ncalrpc"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp") Found string "+ncalrpc:[OLE7FE66302541B44C8A41226835BE5]" (Indicator: "ncalrpc"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string "A+ncalrpc:[OLE51916091907C455C8E6BFCF77F8C]" (Indicator: "ncalrpc"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string "+ncalrpc:[OLE51916091907C455C8E6BFCF77F8C]" (Indicator: "ncalrpc"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string "B+ncalrpc:[OLE7FE66302541B44C8A41226835BE5]" (Indicator: "ncalrpc"; Source: "00000000-00005772.00000000.232406.00110000.00000004.mdmp, 00000000-00005772.00000001.233993.00110000.00000004.mdmp") Found string "+ncalrpc:[OLE2364DBC688CC417BB1E0E91AECAC]" (Indicator: "ncalrpc"; Source: "00000000-00005772.00000000.232406.00110000.00000004.mdmp")4a:T58b,"msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1073809648" "cx": "32" "cy": "32"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2533428068" "cx": "398" "cy": "25"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1073809648" "cx": "16" "cy": "16"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2533428068" "cx": "16" "cy": "16"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "755042122" "cx": "398" "cy": "25"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1073809648" "cx": "90" "cy": "23"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2533428068" "cx": "90" "cy": "23"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "218171500" "cx": "32" "cy": "32"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "218171500" "cx": "16" "cy": "16"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2533428068" "cx": "500" "cy": "316"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "167839825" "cx": "493" "cy": "312"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1073809648" "cx": "398" "cy": "25"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2533428068" "cx": "499" "cy": "25"}4b:Ta78,Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp")4c:T45a,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp")4d:T423,Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp")4e:T73c,Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetQueryDisplayInformation" (Indicator: "NetQueryDisplayInformation"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NetUserGetInfo failed. Error:" (Indicator: "NetUserGetInfo"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "LookupAccountSidW returned" (Indicator: "LookupAccountSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp")4f:T183d,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "\Device\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found string "\Device\{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00003280.00000002.231507.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.013F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\CelasTradePro\Updater.exe" (Indicator: "\Device\"; Source: "00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp") Found string "\Device\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00003468.00000000.234247.002F0000.00000004.mdmp") Found string "\Device\{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005772.00000000.232406.00110000.00000004.mdmp, 00000000-00005772.00000001.233993.00110000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005772.00000000.232406.00110000.00000004.mdmp, 00000000-00005772.00000001.233993.00110000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005772.00000000.232406.00110000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005772.00000000.232406.00110000.00000004.mdmp, 00000000-00005772.00000001.233993.00110000.00000004.mdmp")50:T40c,Found reference to API "WRPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00003280.00000000.227664.00280000.00000004.mdmp, 00000000-00003280.00000001.229584.00280000.00000004.mdmp, 00000000-00003280.00000002.231507.00280000.00000004.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "WRPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00005432.00000000.228329.000D0000.00000004.mdmp, 00000000-00005432.00000001.230252.000D0000.00000004.mdmp, 00000000-00005432.00000002.232175.000D0000.00000004.mdmp, 00000000-00005432.00000003.234522.000D0000.00000004.mdmp") Found reference to API "WRPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00005772.00000000.232406.00110000.00000004.mdmp, 00000000-00005772.00000001.233993.00110000.00000004.mdmp")51:T1133,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "AllocateAndInitializeSid failed and returned" (Indicator: "AllocateAndInitializeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "AllocateAndInitializeSid failed and returned" (Indicator: "InitializeSid"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp")52:T45c,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003280.00000002.231507.004C1000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003468.00000001.235257.0116D000.00000002.mdmp")53:T4b7,"FindResourceW@KERNEL32.DLL" in "msiexec.exe" "FindNextFileW@KERNEL32.DLL" in "msiexec.exe" "GetLogicalDriveStringsW@KERNEL32.DLL" in "msiexec.exe" "send@WS2_32.DLL" in "msiexec.exe" "CreateDirectoryW@KERNEL32.DLL" in "msiexec.exe" "LoadLibraryW@KERNEL32.DLL" in "msiexec.exe" "GetLogicalDriveStringsA@KERNEL32.DLL" in "msiexec.exe" "FindNextFileA@KERNEL32.DLL" in "msiexec.exe" "FindFirstFileA@KERNEL32.DLL" in "msiexec.exe" "FindFirstFileW@KERNEL32.DLL" in "msiexec.exe" "GetNativeSystemInfo@KERNEL32.DLL" in "msiexec.exe" "Process32FirstW@KERNEL32.DLL" in "msiexec.exe" "LoadLibraryExA@KERNEL32.DLL" in "msiexec.exe" "CreateToolhelp32Snapshot@KERNEL32.DLL" in "msiexec.exe" "WinExec@KERNEL32.DLL" in "msiexec.exe" "LoadLibraryA@KERNEL32.DLL" in "msiexec.exe" "EncryptMessage@SSPICLI.DLL" in "msiexec.exe" "CreateProcessA@KERNEL32.DLL" in "msiexec.exe" "RemoveDirectoryW@KERNEL32.DLL" in "msiexec.exe" "FindResourceA@KERNEL32.DLL" in "msiexec.exe" "CreateProcessW@KERNEL32.DLL" in "msiexec.exe" "LoadResource@KERNEL32.DLL" in "msiexec.exe" "CreateDirectoryA@KERNEL32.DLL" in "msiexec.exe" "LoadLibraryExW@KERNEL32.DLL" in "msiexec.exe" "DecryptMessage@SSPICLI.DLL" in "msiexec.exe"54:T7dc,"Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "")55:Tc30,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca.com" Response ==> HTTP/1.1 200 OK Date: Wed 17 Jul 2024 01:42:09 GMT Content-Type: application/ocsp-response Content-Length: 2232 Connection: keep-alive Last-Modified: Sun 14 Jul 2024 12:18:35 GMT Expires: Sun 21 Jul 2024 12:18:34 GMT Etag: "f765226a713004f7a090ec7348f2fddd7558bae0" Cache-Control: max-age=603420 s-maxage=1800 public no-transform must-revalidate X-CCACDN-Proxy-ID: scdpinlb1 X-Frame-Options: SAMEORIGIN CF-Cache-Status: HIT Age: 678 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8a4688a7d984aab5-SJC with response body ==>308208B40A0100A08208AD308208A906092B06010505073001010482089A3082089630819EA2160414445B9CCBECF6D82C2E5D4E4F32923DDC799440B6180F32....... "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca.com" Response ==> HTTP/1.1 200 OK Date: Wed 17 Jul 2024 01:42:11 GMT Content-Type: application/ocsp-response Content-Length: 527 Connection: keep-alive Last-Modified: Sat 13 Jul 2024 21:43:31 GMT Expires: Sat 20 Jul 2024 21:43:30 GMT Etag: "fa572cffe83f23b9bdcf4852a2d8daba44bd92e3" Cache-Control: max-age=427919 s-maxage=1800 public no-transform must-revalidate X-CCACDN-Proxy-ID: scdpinlb1 X-Frame-Options: SAMEORIGIN CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Server: cloudflare CF-RAY: 8a4688b39822aab5-SJC with response body ==>3082020B0A0100A08202043082020006092B0601050507300101048201F1308201ED3081D6A2160414299160FF8A4DFAEBF9A66AB8CFF9E64BBD49CE12180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5418 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 17 Jul 2024 01:42:16 GMT Last-Modified: Wed 17 Jul 2024 00:11:58 GMT Server: ECAcc (sac/2579) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041445EBA2AFF492CB82312D518BA7A7219DF36DC80F180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5334 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 17 Jul 2024 01:42:20 GMT Last-Modified: Wed 17 Jul 2024 00:13:27 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604141500122B1398B29907ED1EDFA2BE570D2B6702CD180F32.......56:T63b,"Qt5Core.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Qt5Widgets.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Qt5Gui.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "CelasTradePro.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: N/A] "Qt5Script.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "qwindows.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Qt5Network.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: N/A] "Updater.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "zlib.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI60D9.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI44CF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI3D3F.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI5959.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MSI6B17.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A]1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791491389838,"unified_at":"2026-10-08T20:29:49.838Z","metadata":{"hashes":{"sha256":"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652","sha1":"258537df5611d9cbf3f8f3f6ea703f35e0e47dfa","md5":"4126e1f34cf282c354e17587bb6e8da3","sha512":"8d5cf46a23418361a3b0f2fb03e172b81f51ff29b33a782c1d8db43aeaf3c46fe0f102f83b220286e82cf2c38dc27de96ae8105fc0c82bed7b8b17aef879c8e4","ssdeep":"196608:wc0YaAWH7ICcfRLdq81w920W+ZP6g2DsjW1TIZfxgNu1DZNJQfIYizTrh50:wvUWHECcfBdR1w9NWqSg2DsK1TmfxgiD","ssdeep_chunks":["196608:wc0YaAW","196608:c0YaAWH","196608:0YaAWH7","196608:YaAWH7I","196608:aAWH7IC","196608:AWH7ICc","196608:WH7ICcf","196608:H7ICcfR","196608:7ICcfRL","196608:ICcfRLd","196608:CcfRLdq","196608:cfRLdq8","196608:fRLdq81","196608:RLdq81w","196608:Ldq81w9","196608:dq81w92","196608:q81w920","196608:81w920W","196608:1w920W+","196608:w920W+Z","196608:920W+ZP","196608:20W+ZP6","196608:0W+ZP6g","196608:W+ZP6g2","196608:+ZP6g2D","196608:ZP6g2Ds","196608:P6g2Dsj","196608:6g2DsjW","196608:g2DsjW1","196608:2DsjW1T","196608:DsjW1TI","196608:sjW1TIZ","196608:jW1TIZf","196608:W1TIZfx","196608:1TIZfxg","196608:TIZfxgN","196608:IZfxgNu","196608:ZfxgNu1","196608:fxgNu1D","196608:xgNu1DZ","196608:gNu1DZN","196608:Nu1DZNJ","196608:u1DZNJQ","196608:1DZNJQf","196608:DZNJQfI","196608:ZNJQfIY","196608:NJQfIYi","196608:JQfIYiz","196608:QfIYizT","196608:fIYizTr","196608:IYizTrh","196608:YizTrh5","196608:izTrh50","393216:wc0YaAW","393216:c0YaAWH","393216:0YaAWH7","393216:YaAWH7I","393216:aAWH7IC","393216:AWH7ICc","393216:WH7ICcf","393216:H7ICcfR","393216:7ICcfRL","393216:ICcfRLd","393216:CcfRLdq","393216:cfRLdq8","393216:fRLdq81","393216:RLdq81w","393216:Ldq81w9","393216:dq81w92","393216:q81w920","393216:81w920W","393216:1w920W+","393216:w920W+Z","393216:920W+ZP","393216:20W+ZP6","393216:0W+ZP6g","393216:W+ZP6g2","393216:+ZP6g2D","393216:ZP6g2Ds","393216:P6g2Dsj","393216:6g2DsjW","393216:g2DsjW1","393216:2DsjW1T","393216:DsjW1TI","393216:sjW1TIZ","393216:jW1TIZf","393216:W1TIZfx","393216:1TIZfxg","393216:TIZfxgN","393216:IZfxgNu","393216:ZfxgNu1","393216:fxgNu1D","393216:xgNu1DZ","393216:gNu1DZN","393216:Nu1DZNJ","393216:u1DZNJQ","393216:1DZNJQf","393216:DZNJQfI","393216:ZNJQfIY","393216:NJQfIYi","393216:JQfIYiz","393216:QfIYizT","393216:fIYizTr","393216:IYizTrh","393216:YizTrh5","393216:izTrh50","196608:wvUWHEC","196608:vUWHECc","196608:UWHECcf","196608:WHECcfB","196608:HECcfBd","196608:ECcfBdR","196608:CcfBdR1","196608:cfBdR1w","196608:fBdR1w9","196608:BdR1w9N","196608:dR1w9NW","196608:R1w9NWq","196608:1w9NWqS","196608:w9NWqSg","196608:9NWqSg2","196608:NWqSg2D","196608:WqSg2Ds","196608:qSg2DsK","196608:Sg2DsK1","196608:g2DsK1T","196608:2DsK1Tm","196608:DsK1Tmf","196608:sK1Tmfx","196608:K1Tmfxg","196608:1Tmfxgi","196608:TmfxgiD"],"imphash":"Unknown"},"file_info":{"file_name":"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652","file_type":["msi","data"],"file_type_id":"msi","file_size":9830400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1721180475000,"last_seen":1721180476000,"last_multi_scan":1721180476000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["downloader","jeus","labyrinthchollima","nukesped","targeted"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":76},"sandbox_signatures":{"informative_count":185,"suspicious_count":13,"malicious_count":4,"total":202},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Lazarus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/Lazarus","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Scans for the windows taskbar (may be used for explorer injection)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to convert data from binary to string"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"YARA signature match – AES instruction used"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - Embedded PDF document"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Hooks API calls"},{"type":"malicious","value":"Hooks file system APIs"},{"type":"malicious","value":"Hooks internet related APIs"},{"type":"malicious","value":"Hooks key cryptographic functions of the CryptoAPI"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Opens the MountPointManager (often used to detect additional infection locations)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"suspicious","value":"Contains ability to enumerate services"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"suspicious","value":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"},{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"YARA signature match – Public-private key pair"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"suspicious","value":"GETs files from a webserver"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"msiexec.exe\" called \"FindResourceW\" with parameter \"9990\" - (UID: 00000000-00003280)\n \"msiexec.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00003280)\n \"msiexec.exe\" called \"FindResourceW\" with parameter \"9991\" - (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\MSI482c3.tmp (UID: 00000000-00001200)\n \"msiexec.exe\" called \"RemoveDirectoryW\" with parameter Z:\\MSI482c4.tmp (UID: 00000000-00001200)\n \"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\Config.Msi (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"ControlService failed.\" (Indicator: \"ControlService\"; File: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"ControlService failed.\" (Indicator: \"ControlService\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"OpenService failed.\" (Indicator: \"OpenService\"; File: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"OpenService failed.\" (Indicator: \"OpenService\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MSCF2Wqh disallowedcert.stl|f~3\"{-UAV>F :n;lpd`()\nhvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x\"3`CM:k^nLuSvMxfx4qM?{i%CVl\\tP-`}v?@s)?hRQ>jB@H4-\" (Indicator: \"Oid\"; File: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003280.00000002.231507.00280000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003280.00000002.231507.00280000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"Updater.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003280-54606-20-004C1D10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from binary to string","description":"$28","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-230","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 00000000-00003280-54606-18-004CB385\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 00000000-00003280-54606-18-004CB385\n Assembly shows XOR instruction xor byte ptr [eax]\n al in Stream UID: 00000000-00003280-54606-17-004CBA3F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.973329925032759","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Hooks key cryptographic functions of the CryptoAPI\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts domains\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00003468.00000000.234247.002C0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00003468.00000000.234247.002C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Updater.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"zlib.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"MSI60D9.tmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"36ded51b.rbs\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"msiexec.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001200)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"msiexec.exe\" called \"IsWow64Process\" with parameter \"1200\" - (UID: 00000000-00001200)\n \"msiexec.exe\" called \"IsWow64Process\" with parameter \"3280\" - (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"msiexec.exe\" called \"GetWindowTextW\" (UID: 00000000-00001200)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Preparing to install...\" - (UID: 00000000-00001200)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00001200)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"msiexec.exe\" called \"GetActiveWindow\" (UID: 00000000-00001200)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001200)\n \"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"msiexec.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00001200)\n \"msiexec.exe\" called \"OpenMutexW\" with parameter \"Global\\_MSIExecute\" - (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Updater.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003468)\n \"Updater.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003468)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"msiexec.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001200)\n \"msiexec.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003280)\n \"msiexec.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003280)\n \"msiexec.exe\" called \"LookupAccountSidW\" with param Name Administrators (UID: 00000000-00003280)\n \"msiexec.exe\" called \"LookupAccountSidW\" with param Name Backup Operators (UID: 00000000-00003280)\n \"msiexec.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003280)\n \"msiexec.exe\" called \"LookupAccountSidW\" with param Name LOCAL SERVICE (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00001200)\n \"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001200)\n \"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003280)\n \"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00003280)\n \"msiexec.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"IsWow64Process,kernel32.dll,\"255:43:53.289\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003280.00000002.231507.00280000.00000004.mdmp\")\n Found reference to API \"4,3144,,IsWow64Process,kerne\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003280.00000002.231507.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"2,3147,,GetLocaleInfoW,kerne\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003280.00000002.231507.00280000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Updater.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00001200-0000010C-4984934\n \"msiexec.exe\" queries volume information of \"C:\\share\" at 00000000-00001200-0000010C-48842732\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00001200-0000010C-64173172\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003280-0000010C-45532240\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003280-0000010C-45537082\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003280-0000010C-78632633\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003280-0000010C-78635238","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00001200-0000010C-4984934\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00001200-0000010C-64173172\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003280-0000010C-45532240\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003280-0000010C-45537082\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003280-0000010C-78632633\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003280-0000010C-78635238","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Updater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Updater.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.comodoca.com\"\n \"ocsp.digicert.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Branch\\win\\Release\\custact\\x86\\AICustAct.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$31","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00003280-54606-27-004C12E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"LogonUser API returned:\" (Indicator: \"LogonUser\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"MoveFiles\" (Indicator: \"MoveFile\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n file/memory contains long string with (Indicator: \"StartService\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"StartServices\" (Indicator: \"StartService\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute\"\n \"Global\\_MSIExecute\"\n \"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"msiexec.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"msiexec.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"msiexec.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2.dll\" - [base:0; Status:c0000135]\n \"msiexec.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"msiexec.exe\" failed to load missing module \"%WINDIR%\\system32\\TSAPPCMP.DLL\" - [base:0; Status:c0000135]\n \"MsiExec.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"MsiExec.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"libeay32.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"Qt5Script.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"qwindows.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"Qt5Network.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"ssleay32.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"Updater.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"zlib.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"MSI60D9.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"$35","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"er-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003468.00000001.235257.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 699A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74D00000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 748C0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 693F0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68C40000\n \"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 69110000\n \"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68960000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76240000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76240000\n \"Updater.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76240000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cdab06c@ADVAPI32.dll\"\n \"0e000f00ecdab06c@ADVAPI32.dll\"\n \"0e000f0048dbb06c@ADVAPI32.dll\"\n \"1100120024e3b06c@ADVAPI32.dll\"\n \"11001200c0e3b06c@ADVAPI32.dll\"\n \"1200130004e4b06c@ADVAPI32.dll\"\n \"120013005ce4b06c@ADVAPI32.dll\"\n \"140015008005b16c@ADVAPI32.dll\"\n \"140015009805b16c@ADVAPI32.dll\"\n \"14001500b005b16c@ADVAPI32.dll\"\n \"17001800c805b16c@ADVAPI32.dll\"\n \"0d000e00e005b16c@ADVAPI32.dll\"\n \"0d000e00d0feb06c@WININET.dll\"\n \"0d000e0040ffb06c@WININET.dll\"\n \"1000110078ffb06c@WININET.dll\"\n \"100011001c00b16c@WININET.dll\"\n \"100011001006b16c@WININET.dll\"\n \"100011002406b16c@WININET.dll\"\n \"140015003806b16c@WININET.dll\"\n \"140015005006b16c@WININET.dll\"\n \"120013006806b16c@WININET.dll\"\n \"120013007c06b16c@WININET.dll\"\n \"100011005c00b16c@WININET.dll\"\n \"12001300e000b16c@urlmon.dll\"\n \"120013005401b16c@urlmon.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$37","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$38","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Updater.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\LOCALSERVER32\")\n \"Updater.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\LOCALSERVER32\")\n \"Updater.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \"Updater.exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00000000-00003280) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PSModulePath, APPDATA, USERNAME, Path, PATHEXT, TEMP, USERPROFILE, TMP\"\n Process \"msiexec.exe\" (UID: 00000000-00003280) was launched with missing environment variables: \"LOGONSERVER, PROMPT, HOMEPATH, HOMEDRIVE\"\n Process \"MsiExec.exe\" (UID: 00000000-00005432) was launched with new environment variables: \"LOGONSERVER=\"%HOSTNAME%\", PROMPT=\"$P$G\", HOMEPATH=\"\\Users\\%OSUSER%\", HOMEDRIVE=\"C:\"\"\n Process \"MsiExec.exe\" (UID: 00000000-00005432) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PSModulePath, APPDATA, USERNAME, Path, PATHEXT, TEMP, USERPROFILE, TMP\"\n Process \"MsiExec.exe\" (UID: 00000000-00005772) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT\"\n Process \"MsiExec.exe\" (UID: 00000000-00005772) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ocsp.comodoca.com\"\n \"ocsp.digicert.com\"\n \"www.celasllc.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Updater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Updater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00003280)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 53815E6E59CEF4C1DCDC711C03E15217 C\" (UID: 00000000-00005432)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 0E76465C1242F25E89498A7AD0DF4338\" (UID: 00000000-00005772)\n Spawned process \"Updater.exe\" with commandline \"CheckUpdate\" (UID: 00000000-00003468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00003280)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 53815E6E59CEF4C1DCDC711C03E15217 C\" (UID: 00000000-00005432)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 0E76465C1242F25E89498A7AD0DF4338\" (UID: 00000000-00005772)\n Spawned process \"Updater.exe\" with commandline \"CheckUpdate\" (UID: 00000000-00003468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"libeay32.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Qt5Script.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"qwindows.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Qt5Network.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ssleay32.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Updater.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"zlib.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSI60D9.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"msiexec.exe\" connecting to \"\\ThemeApiPort\"\n \"MsiExec.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"msiexec.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"MSI60D9.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"TarF7A8.tmp\" has type \"data\"\n \"MSI9A2E.tmp\" has type \"data\"\n \"MSI44CF.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSI3D3F.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSI5959.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSI6B17.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"CabF7A7.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 71954 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$3b","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"msiexec.exe\" opens a process \"C:\\Windows\\System32\\msiexec.exe\" (UID: 00000000-00001200)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"msiexec.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"msiexec.exe\" queries basic process information of the \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (UID: 1200)\n \"msiexec.exe\" queries basic process information of the \"C:\\Windows\\System32\\RstrtMgr.dll\" (UID: 3280)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055.011","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Able to identify sandbox environment running process","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"msiexec.exe\" trying to access non-existent file \"C:\\Windows\\System32\\msiexec.exe.Config\"\n \"msiexec.exe\" trying to access non-existent file \"C:\\Windows\\System32\\msiexec.exe.Local\\\"\n \"msiexec.exe\" trying to access non-existent file \"A:\"\n \"msiexec.exe\" trying to access non-existent file \"B:\"\n \"msiexec.exe\" trying to access non-existent file \"D:\"\n \"msiexec.exe\" trying to access non-existent file \"E:\"\n \"msiexec.exe\" trying to access non-existent file \"F:\"\n \"msiexec.exe\" trying to access non-existent file \"G:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"Updater.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /checkupdate.php\" - (UID: 00000000-00003468)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"msiexec.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001200)\n \"msiexec.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003280)\n \"MsiExec.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005432)\n \"MsiExec.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005772)\n \"Updater.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003468)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$41","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"$42","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"Updater.exe\" called \"InternetOpenA with parameter Request\" (UID: 00000000-00003468)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D\"\n Found http requests in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")\n Found reference to API \"49324349926,4076,3200,,HttpOpenRequestA,Wininet.dll,\"254:44:43.370\",RX=0,PX=0\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003468.00000001.235257.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$45","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00003280.00000002.231507.013F0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"14.5.2.0\"\n \"192.168.0.2\"\n \"1.0.0.0\"\n \"5.2.1.0\"\n \"1.0.2.15\"\n \"1.2.11.0\"\n Potential IP \"27.0.0.187\" found in string \"obe Flash Player 27 ActiveX 27.0.0.187\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.15\"\n \"2.5.29.31\"\n \"2.5.29.17\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.16\"\n \"2.5.29.4\"\n \"2.5.29.10\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.17\"\n \"2.5.4.9\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"ST /checkupdate.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d\n Observed JA3 fingerprint: db95a4cb23548a635a1dfebcee9991cb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.thawte.com\"\n Found HTTPS url \"https://www.advancedinstaller.com\"\n Found HTTPS url \"https://d.symcb.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"libeay32.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Embedded PDF document","description":"YARA signature for embedded PDF matched on file \"Qt5Gui.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":1,"id":"yara-33","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in file \"zlib.dll\"\n YARA signature for zlib compression library used in file \"Qt5Core.dll\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – AES instruction used","description":"YARA signature matched on AES instruction used in file \"libeay32.dll\"","origin":"YARA Signature","mitre_attack_id":"T1140","relevance":2,"id":"yara-138","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$4a","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"msiexec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MsiExec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Updater.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Updater.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"msiexec.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00001200)\n \"msiexec.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00001200)\n \"msiexec.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00001200)\n \"msiexec.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00001200)\n \"msiexec.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_* (UID: 00000000-00001200)\n \"msiexec.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_* (UID: 00000000-00001200)\n \"msiexec.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_* (UID: 00000000-00001200)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00003280.00000002.231507.00280000.00000004.mdmp\")\n Found string \"@aEs\" (Indicator: \"aes\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")\n Found string \"aEsx\" (Indicator: \"aes\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")\n Found string \"`aEs\" (Indicator: \"aes\"; Source: \"00000000-00003280.00000002.231507.013F0000.00000004.mdmp\")\n Found string \"@aEs\" (Indicator: \"aes\"; Source: \"00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp\")\n Found string \"aEsH\" (Indicator: \"aes\"; Source: \"00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp\")\n Found string \"`aEsp\" (Indicator: \"aes\"; Source: \"00000000-00003468.00000000.234247.002F0000.00000004.mdmp, 00000000-00003468.00000001.235257.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"NetGetDCName\" (Indicator: \"GetDC\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"::NetGetDCName failed. Error:\" (Indicator: \"GetDC\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"FDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"msiexec.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001200)\n \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (UID: 00000000-00001200), \"msiexec.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003280), \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Installer\\36ded51a.ipi\" (UID: 00000000-00003280)\n \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: \\\\?\\Volume{dcbfaac3-d86\" (UID: 00000000-00003280), \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Installer\\MSI9A2E.tmp\" (UID: 00000000-00003280)\n \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Config.Msi\\36ded51b.rbs\" (UID: 00000000-00003280), \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Program Files\\CelasTradePro\" (UID: 00000000-00003280)\n \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Installer\\36ded51c.msi\" (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeServiceLogonRight\" (Indicator: \"SeServiceLogonRight\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003280.00000002.231507.004C1000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003468.00000001.235257.0116D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00003468.00000000.234247.002F0000.00000004.mdmp\n 00000000-00003468.00000001.235257.002F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Updater.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"$53","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"\n \"Updater.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")\n Found reference to API \"NetApiBufferFree return:\" (Indicator: \"NetApiBufferFree\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00003468.00000000.234247.002C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"msiexec.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00001200)\n \"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 20f34f84687aca01 & 20f34f84687aca01 (UID: 00000000-00001200)\n \"msiexec.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003280)\n \"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 20f34f84687aca01 & 20f34f84687aca01 (UID: 00000000-00003280)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"OpenSCManagerW@ADVAPI32.DLL at 00000000-00003280-54606-17-004CBA3F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1007","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"msiexec.exe\" (Thread ID: 4088) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"info@diginotar.nl0\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"General","name":"GETs files from a webserver","description":"$55","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Public-private key pair","description":"YARA signature for public-private key pair used in file \"Qt5Network.dll\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-122","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"Updater.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003468.00000000.234247.002C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Updater.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"Updater.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"Updater.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"Updater.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Updater.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"MSI60D9.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"MSI44CF.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"MSI3D3F.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"MSI5959.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"MSI6B17.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 71954 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- [targetUID: N/A]\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- [targetUID: N/A]\n \"CabF7A7.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 71954 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"\n \"msiexec.exe\" touched \"R:\"\n \"msiexec.exe\" touched \"S:\"\n \"msiexec.exe\" touched \"T:\"\n \"msiexec.exe\" touched \"U:\"\n \"msiexec.exe\" touched \"V:\"\n \"msiexec.exe\" touched \"W:\"","origin":"API Call","mitre_attack_id":"T1120","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Hooks file system APIs","description":"\"FindNextFileW@KERNEL32.DLL\" in \"msiexec.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"msiexec.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"msiexec.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"msiexec.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"MsiExec.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"MsiExec.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"MsiExec.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"MsiExec.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"malicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"EncryptMessage@SSPICLI.DLL\" in \"msiexec.exe\"\n \"DecryptMessage@SSPICLI.DLL\" in \"msiexec.exe\"\n \"EncryptMessage@SSPICLI.DLL\" in \"MsiExec.exe\"\n \"DecryptMessage@SSPICLI.DLL\" in \"MsiExec.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"msiexec.exe\" allocated memory in \"%WINDIR%\\system32\\msiexec.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"msiexec.exe\"\n \"send@WS2_32.DLL\" in \"MsiExec.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":125,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":3,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["downloader","jeus","labyrinthchollima","nukesped","targeted"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6697213b910707694e054ee2","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652","analysis_start_time":"2024-07-17T01:41:16+00:00","indicators_count":{"informative":185,"suspicious":39,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"ocsp.comodoca.com","address":"172.64.149.23","ttl":224,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Comodo Group, Inc.","registrar_name_servers":"NS0.COMODODNS.COM","registrar_creation_date":"2002-11-13T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"domain":"ocsp.digicert.com","address":"192.229.211.108","ttl":5123,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"domain":"www.celasllc.com","country":"-","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_name_servers":"1A7EA920.BITCOIN-DNS.HOSTING","registrar_creation_date":"2018-05-29T02:17:18+00:00","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}],"http_requests":[{"host":"ocsp.comodoca.com","host_ip":"172.64.149.23:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.comodoca.com","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"host":"ocsp.comodoca.com","host_ip":"172.64.149.23:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg%2F4pN%2Buv5pmq4z%2FnmS71JzhICEQCac1ULg3aGO9lDD6qLWimH HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.comodoca.com","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}],"processes":[{"pid":1200,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652.msi\"","sha256":"83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00001200","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":3280,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00003280","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":5432,"ppid":3280,"name":"MsiExec.exe","command_line":"-Embedding 53815E6E59CEF4C1DCDC711C03E15217 C","sha256":"83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22","normalized_path":"%WINDIR%\\system32\\MsiExec.exe","parent_uid":"00000000-00003280","uid":"00000000-00005432"},{"pid":5772,"ppid":3280,"name":"MsiExec.exe","command_line":"-Embedding 0E76465C1242F25E89498A7AD0DF4338","sha256":"83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22","normalized_path":"%WINDIR%\\system32\\MsiExec.exe","parent_uid":"00000000-00003280","uid":"00000000-00005772"},{"pid":3468,"ppid":3280,"name":"Updater.exe","command_line":"CheckUpdate","sha256":"d555dcb6da4a6b87e256ef75c0150780b8a343c4a1e09935b0647f01d974d94d","normalized_path":"%PROGRAMFILES%\\CelasTradePro\\Updater.exe","parent_uid":"00000000-00003280","uid":"00000000-00003468"}],"all_imported_dlls":["ntmarta.dll","gdi32.dll","usp10.dll","netapi32.dll","npmproxy.dll","devobj.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","msimsg.dll","riched20.dll","wshqos.dll","profapi.dll","cabinet.dll","cryptsp.dll","SensApi.dll","credssp.dll","vss_ps.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","urlmon.dll","devrtl.dll","vssapi.dll","samcli.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","msihnd.dll","comdlg32.dll","winsta.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","msisip.dll","Wldap32.dll","cscapi.dll","slc.dll","KernelBase.dll","iertutil.dll","RpcRtRemote.dll","WSHTCPIP.DLL","vsstrace.dll","samlib.dll","normaliz.dll","srclient.dll","linkinfo.dll","rpcrt4.dll","lpk.dll","oleaut32.dll","propsys.dll","wship6.dll","dsrole.dll","winmm.dll","setupapi.dll","cfgmgr32.dll","srvcli.dll","shlwapi.dll","AcGenral.dll","mscoreei.dll","spp.dll","clr.dll","kernel32.dll","advapi32.dll","msvcrt.dll","dwmapi.dll","msasn1.dll","gpapi.dll","cryptbase.dll","clbcatq.dll","winnsi.dll","mscoree.dll","fusion.dll","es.dll","ws2_32.dll","msi.dll","apphelp.dll","sfc_os.dll","mswsock.dll","dhcpcsvc6.dll","FWPUCLNT.DLL","version.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","nsi.dll","rpcss.dll","dhcpcsvc.dll","bcrypt.dll","dnsapi.dll","ntshrui.dll","logoncli.dll","userenv.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msxml3r.dll","sechost.dll","netutils.dll","webio.dll","RstrtMgr.dll","uxtheme.dll","ncrypt.dll","bcryptprimitives.dll","eventcls.dll","sspicli.dll","rsaenh.dll","nlaapi.dll","shell32.dll","wininet.dll","atl.dll","user32.dll","ole32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","imm32.dll","fltLib.dll","wintrust.dll","sxs.dll","ntdll.dll","mpr.dll","msacm32.dll","sfc.dll","comctl32.dll","secur32.dll","winhttp.dll","rasadhlp.dll","msxml3.dll","netprofm.dll","AcLayers.dll","msctf.dll","VxSSL32.dll","wkscli.dll","crypt32.dll","cryptnet.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Qt5Core.dll","sha256":"33dbcfe4e6215f8f76e47b9fda9f314d0a8118fc3b90151caf0632a052dd7c58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Qt5Widgets.dll","sha256":"83fb63933f0d813d4c6e6666ede4f1d3d516758ca6fc4f5d52165fe39031596c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Qt5Gui.dll","sha256":"dbcf78702df3a23100d7859ad21be79617020b253797f93c07b5ece169f08724","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"CelasTradePro.exe","sha256":"689b55b7d82dce71e7a265e49c42237cfdf438b4c1242b7148d7ffc2a1a77373","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"libeay32.dll","sha256":"78ddcf743f9b480419e3285b38fd6dbd07266c8cee40306ff80a674be1689d2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Qt5Script.dll","sha256":"680aec1769da9513fd2781508f7655afbd16d5bd9b9c544734f0ca1e5f5fc1bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"qwindows.dll","sha256":"21ad23b705ca8d79bce7482b66238063cb256e5bf37a5f31f633acc816bb71c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Qt5Network.dll","sha256":"10681df239a585815213e9ea704575182a3961306fb9bb8ead9fa8b55ae9121f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"ssleay32.dll","sha256":"8c1fdc792f2dbb8e23225e5576eebb289479907d62fdebf6ec61dae0efec621a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Updater.exe","sha256":"d555dcb6da4a6b87e256ef75c0150780b8a343c4a1e09935b0647f01d974d94d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"zlib.dll","sha256":"189d62ada602e5025189b4c5084e80a13f6c6f990d965205fb594b97d340bd26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"CelasTradePro.lnk","sha256":"aec9f40fb27608ffd16e91625052462977ecc62484384807fe5a35d9a2518535","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"MSI60D9.tmp","sha256":"5ecd3ff2fb862db239babc08ffab2e380cb7663f5bb4643ce5613691c5206808","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"TarF7A8.tmp","sha256":"8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"MSI9A2E.tmp","sha256":"ca5f2633be7e299029a105ef4c91ad3966e4619de2bbd8bd814be272c13fbf31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"36ded51b.rbs","sha256":"42bb96ce2ae220144b8a1b4c62e96d1970cba17d8d130884928c470f6725cefb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"0b6b5f881a38da76baff3393ccbd19f874f92a848dcadddd37c820eb5aac9ff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"path":"\\\\?\\Volume{dcbfaac3-d863-11e","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{C4E2711A-F62D-494B-A2E6-3883B4336731}\\","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-CB-87\\","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{C4E2711A-F62D-494B-A2E6-3883B4336731}\\00-50-56-91-CB-87\\","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{C4E2711A-F62D-494B-A2E6-3883B4336731}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-CB-87\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6697213b910707694e054ee2"}]}]}},"report_ids":{"sandbox_job_ids":["6697213b910707694e054ee2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan/Lazarus Sample 6829b51523f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6829b51523f6…. Malware family: Trojan/Lazarus. Threat score 100/100. 1/24 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/Lazarus Sample 6829b51523f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6829b51523f6…. Malware family: Trojan/Lazarus. Threat score 100/100. 1/24 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6829b51523f69bd0ea6ebc6157e989d269661567f3e62d92ae26d71e6abf6652"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/Lazarus Sample 6829b51523f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6829b51523f6…. Malware family: Trojan/Lazarus. Threat score 100/100. 1/24 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L57","11",{}]]