24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/NukeSped.OY trojan Sample aa124a4b4df1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aa124a4b4df1…. Malware family: Win64/NukeSped.OY trojan. Threat score 100/100. 6/24 AV engines flagged this file. 5 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868","keywords":["Malicious","Win64/NukeSped.OY trojan","malware analysis","sandbox report","threat intelligence","aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"],"about":{"@type":"SoftwareApplication","name":"aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868","applicationCategory":["msi","data"],"identifier":"aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/NukeSped.OY trojan","antivirusDetections":{"malicious":6,"total":24},"behavioralIndicators":{"malicious":5,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T196a,"3CXDesktopApp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000456e00005a0300000000b85e5b0354f73003cc2c456eb85e5b030000000060f7300324f6446eb85e5b03ccf730039fdf446eb85e5b034000000088b4461c000000002a5e5b03c0df446e00000000a6f73003b85e5b03a8f73003b85e5b03000000001d000000080000009e290677d8f55b0300000000280000002400000000005a0368f830030700000010fa3003501b466e01000000ecf73003d0071b0330000000a8f830030800000000001b03285e5b0374d8300378f830038dfe436e30f45b0318ac5a0308000000000000002000000000001b03d0011b03440b1b0300000000400b1b030000000060f8300350f50577d8f55b03c8f8300314f93003 (UID: 00000000-00004940) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004940) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004940) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004976) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa (UID: 00000000-00004976) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d0000000000002099df300d0000000400000000000000a01e8670c801000006000000000000000300000000000000a7405456fe7f00000000000000000000000000000000000000000000000000000101000000000000e0b765a1d50100000a000000000000000000000000000000000000000000000043003a005c0055007300650072007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000498f759fe7f00000000000000000000000000000000000000000000 (UID: 00000000-00004976) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000fc710000020000000000000000000000a0114ca1d5010000000000000000000000004ca1d501000000c04d300d000000003e0859fe7f0000003e0859fe7f0000c03356a1d5010000a0c156a1d5010000a00e4ca1d501000000000000d501000000004ca1d501000000c04d300d000000c091df300d000000000000000000000000000000000000000000000000000000a00e4ca1d501000000000000d501000000004ca1d501000000c04d300d000000000056a1d50100000000000000000000000000000000000000000000000000000000000000000000c00c4ca1d50100000000000000000000ffffffff0000000000000000 (UID: 00000000-00004976) "3CXDesktopApp.exe" called "RtlGetVersion" (UID: 00000000-00004976) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000020cc73a1d5010000000000000000000006000000000000000000000000000000f0a2df300d0000008091fd3dfe7f00005bca73a1d501000004000000000000000600000000000000060000000000000004a7df300d0000008091fd3dfe7f000088c473a1d5010000000000000000000006000000000000000d0000000000000069eefb59fe7f000070d5003efe7f0000926cfd3dfe7f00008091fd3dfe7f00000600000000000000000000000000000040080000000000000500000000000000ad6cfd3dfe7f000000000000612404000000000000040030265ce2c54e4b000001000000000000000100000000000000543ffd3dfe7f000007000000 (UID: 00000000-00004976) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004976) "3CXDesktopApp.exe" called "RtlGetVersion" (UID: 00000000-00002244) "3CXDesktopApp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002244)26:T45c,"msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "MsiExec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "MsiExec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3CXDesktopApp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")27:T702,"msiexec.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")28:Ta7c,"3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\Update.exe" at 00000000-00004976-00000C15-131540066 "3CXDesktopApp.exe" queries volume information of "C:\" at 00000000-00004976-00000C15-131778869 "3CXDesktopApp.exe" queries volume information of "C:\Users" at 00000000-00004976-00000C15-131782988 "3CXDesktopApp.exe" queries volume information of "C:\Users\erRVvNT" at 00000000-00004976-00000C15-131783344 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00004976-00000C15-131783621 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00004976-00000C15-131784312 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00004976-00000C15-131784540 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00004976-00000C15-131784752 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs" at 00000000-00004976-00000C15-131785566 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp" at 00000000-00004976-00000C15-131785833 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app" at 00000000-00004976-00000C15-131786060 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\resources" at 00000000-00004976-00000C15-131786329 "3CXDesktopApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\resources\app.asar" at 00000000-00004976-00000C15-131786735 "3CXDesktopApp.exe" queries volume information of "C:\Users\Default\AppData\Roaming\3CXDesktopApp" at 00000000-00004976-00000C15-132503627 "3CXDesktopApp.exe" queries volume information of "C:\Users\Default\AppData\Roaming\3CXDesktopApp" at 00000000-00004976-00000C15-132612086 "3CXDesktopApp.exe" queries volume information of "C:\Users\Default\AppData\Roaming\3CXDesktopApp" at 00000000-00004976-00000C15-132640044 "3CXDesktopApp.exe" queries volume information of "C:\Users\Default\AppData\Roaming\3CXDesktopApp" at 00000000-00004976-00000C15-132641817 "3CXDesktopApp.exe" queries volume information of "C:\Users\Default\AppData\Roaming\3CXDesktopApp" at 00000000-00004976-00000C15-132644615 "3CXDesktopApp.exe" queries volume information of "C:\Users\Default\AppData\Roaming\3CXDesktopApp" at 00000000-00004976-00000C15-132673532 "3CXDesktopApp.exe" queries volume information of "C:\Users\Default\AppData\Roaming\3CXDesktopApp\logs" at 00000000-00004976-00000C15-13273261629:T546,"msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.MSQ") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.MSQ") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSIEXEC.EXE") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.MSQ"; Key: "DISPLAYNAME") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.MSQ"; Key: "MODIFYPATH") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.MSQ"; Key: "UNINSTALLSTRING") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.MSQ"; Key: "DISPLAYVERSION") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}"; Key: "CONTACT")2a:T7ad,"msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")2b:T463,"msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2c:T7ea,"msiexec.exe" called "CreateDirectoryW" with parameter C:\MSI2d52a.tmp (UID: 00000000-00006048) "msiexec.exe" called "CreateDirectoryW" with parameter Z:\MSI2d52b.tmp (UID: 00000000-00006048) "msiexec.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\3CXDesktopApp (UID: 00000000-00006456) "msiexec.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407 (UID: 00000000-00006456) "msiexec.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\locales (UID: 00000000-00006456) "msiexec.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\resources (UID: 00000000-00006456) "msiexec.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\resources\app.asar.unpacked (UID: 00000000-00006456) "msiexec.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\resources\app.asar.unpacked\dist (UID: 00000000-00006456) "msiexec.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\resources\app.asar.unpacked\dist\main (UID: 00000000-00006456) "msiexec.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\3CX Ltd (UID: 00000000-00006456) "3CXDesktopApp.exe" called "CreateDirectoryW" with parameter %APPDATA%\3CXDesktopApp (UID: 00000000-00004976) "3CXDesktopApp.exe" called "CreateDirectoryW" (UID: 00000000-00004976) "3CXDesktopApp.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\3CXDesktopApp (UID: 00000000-00004976) "3CXDesktopApp.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\3CXDesktopApp\logs (UID: 00000000-00004976) "3CXDesktopApp.exe" called "CreateDirectoryW" with parameter %APPDATA%\3CXDesktopApp\Cache (UID: 00000000-00004976) "3CXDesktopApp.exe" called "CreateDirectoryW" with parameter %APPDATA%\3CXDesktopApp\Cache\Cache_Data (UID: 00000000-00004976)2d:Ta03,"3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.420.16437443595794890634" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.420.17186792391736796487" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\FFFFFFFFFFFFFFFF-4976" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\0000000000000000-4976" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.420.13491308452805409301" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.10791810382145090267" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.16597769955636565456" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.489205319339608628" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.763501756174703214" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.420.2314200388405277925" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.16756553894611987276" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.3740139143028694478" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.12109880082778515377" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.420.6418103523815216454" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.420.16509819057992787072" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.12390994133633520214" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.1721468865934076710" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.420.10020923154801323799" - (UID: 00000000-00004976) "3CXDesktopApp.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.4976.5932.3864411075763892635" - (UID: 00000000-00004976)2e:T65d,"msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\WLDP.DLL (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00006048) "msiexec.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006048)2f:T48d,"msiexec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006048) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006048)30:T85a,"%WINDIR%\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3CXDeskTopApp" in Source: 00000000-00004976-00000C39-13725441363 "01:\Software\Microsoft\3CXDesktopApp\installed" in Source: 00000000-00006456-00000BC1-92708277 "21:\SOFTWARE\3CX Ltd.\3CXDesktopApp\AutoUpdate" in Source: 00000000-00006456-00000BC1-92670662 "21:\Software\Microsoft\3CXDesktopApp\installed" in Source: 00000000-00006456-00000BC1-92694059 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3CXDesktopApp" in Source: 00000000-00006456-00000BC1-92677451 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\DisplayIcon" in Source: 00000000-00006456-00000BC1-92657002 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\DisplayName" in Source: 00000000-00006456-00000BC1-92624530 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\DisplayVersion" in Source: 00000000-00006456-00000BC1-92638629 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\InstallPath" in Source: 00000000-00006456-00000BC1-92618426 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\ModifyPath" in Source: 00000000-00006456-00000BC1-92645808 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\Publisher" in Source: 00000000-00006456-00000BC1-92631801 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\UninstallString" in Source: 00000000-00006456-00000BC1-92651286 "QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3CXDeskTopApp" in Source: reg.exe "SOFTWARE\3CX Ltd.\3CXDesktopApp\Capabilities" in Source: 00000000-00006456-00000BC1-108467142 "Software\Policies\Microsoft\Windows\Installer" in Source: aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868.bin "uSoftware\Policies\Microsoft\Windows\Installer" in Source: aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868.bin31:T553,Antivirus vendors marked dropped file "Update.exe" as clean (type is "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "v8_context_snapshot.bin" as clean (type is "data"), Antivirus vendors marked dropped file "libEGL.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ffmpeg.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "3CXDesktopApp.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "vk_swiftshader.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "d3dcompiler_47.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "vulkan-1.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "snapshot_blob.bin" as clean (type is "data"), Antivirus vendors marked dropped file "MSI5C46.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSI258.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")32:T148dc,Found string "AllowSetForegroundWindow" (Indicator: "SetForegroundWindow"; in File: "3CXDesktopApp.exe.1413653332") Found string "CloseHandle" (Indicator: "CloseHandle"; in File: "3CXDesktopApp.exe.1413653332") Found string "CorExitProcess" (Indicator: "ExitProcess"; in File: "3CXDesktopApp.exe.1413653332") Found string "CreateFileW" (Indicator: "CreateFileW"; in File: "3CXDesktopApp.exe.1413653332") Found string "CreateProcessW" (Indicator: "CreateProcessW"; in File: "3CXDesktopApp.exe.1413653332") Found string "DecodePointer" (Indicator: "DecodePointer"; in File: "3CXDesktopApp.exe.1413653332") Found string "DeleteCriticalSection" (Indicator: "DeleteCriticalSection"; in File: "3CXDesktopApp.exe.1413653332") Found string "DeleteFileW" (Indicator: "DeleteFileW"; in File: "3CXDesktopApp.exe.1413653332") Found string "EncodePointer" (Indicator: "EncodePointer"; in File: "3CXDesktopApp.exe.1413653332") Found string "EnterCriticalSection" (Indicator: "EnterCriticalSection"; in File: "3CXDesktopApp.exe.1413653332") Found string "ExitProcess" (Indicator: "ExitProcess"; in File: "3CXDesktopApp.exe.1413653332") Found string "FindClose" (Indicator: "FindClose"; in File: "3CXDesktopApp.exe.1413653332") Found string "FindFirstFileExW" (Indicator: "FindFirstFileExW"; in File: "3CXDesktopApp.exe.1413653332") Found string "FindFirstFileW" (Indicator: "FindFirstFileW"; in File: "3CXDesktopApp.exe.1413653332") Found string "FindNextFileW" (Indicator: "FindNextFileW"; in File: "3CXDesktopApp.exe.1413653332") Found string "FlushFileBuffers" (Indicator: "FlushFileBuffers"; in File: "3CXDesktopApp.exe.1413653332") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; in File: "3CXDesktopApp.exe.1413653332") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetACP" (Indicator: "GetACP"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetCommandLineW" (Indicator: "GetCommandLineW"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetConsoleOutputCP" (Indicator: "GetConsoleOutputCP"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetCPInfo" (Indicator: "GetCPInfo"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetFileAttributesW" (Indicator: "GetFileAttributesW"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetFileType" (Indicator: "GetFileType"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetLastError" (Indicator: "GetLastError"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetModuleFileNameW" (Indicator: "GetModuleFileNameW"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetModuleHandleExW" (Indicator: "GetModuleHandleExW"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetModuleHandleW" (Indicator: "GetModuleHandleW"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetOEMCP" (Indicator: "GetOEMCP"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetProcessHeap" (Indicator: "GetProcessHeap"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetStartupInfoW" (Indicator: "GetStartupInfoW"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetStringTypeW" (Indicator: "GetStringTypeW"; in File: "3CXDesktopApp.exe.1413653332") Found string "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; in File: "3CXDesktopApp.exe.1413653332") Found string "HeapAlloc" (Indicator: "HeapAlloc"; in File: "3CXDesktopApp.exe.1413653332") Found string "HeapFree" (Indicator: "HeapFree"; in File: "3CXDesktopApp.exe.1413653332") Found string "HeapReAlloc" (Indicator: "HeapReAlloc"; in File: "3CXDesktopApp.exe.1413653332") Found string "HeapSize" (Indicator: "HeapSize"; in File: "3CXDesktopApp.exe.1413653332") Found string "InitializeCriticalSectionAndSpinCount" (Indicator: "InitializeCriticalSection"; in File: "3CXDesktopApp.exe.1413653332") Found string "InitializeSListHead" (Indicator: "InitializeSListHead"; in File: "3CXDesktopApp.exe.1413653332") Found string "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; in File: "3CXDesktopApp.exe.1413653332") Found string "IsProcessorFeaturePresent" (Indicator: "IsProcessorFeaturePresent"; in File: "3CXDesktopApp.exe.1413653332") Found string "IsValidCodePage" (Indicator: "IsValidCodePage"; in File: "3CXDesktopApp.exe.1413653332") Found string "LCMapStringW" (Indicator: "LCMapStringW"; in File: "3CXDesktopApp.exe.1413653332") Found string "LeaveCriticalSection" (Indicator: "LeaveCriticalSection"; in File: "3CXDesktopApp.exe.1413653332") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in File: "3CXDesktopApp.exe.1413653332") Found string "LocaleNameToLCID" (Indicator: "LocaleNameToLCID"; in File: "3CXDesktopApp.exe.1413653332") Found string "MoveFileExW" (Indicator: "MoveFile"; in File: "3CXDesktopApp.exe.1413653332") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in File: "3CXDesktopApp.exe.1413653332") Found string "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; in File: "3CXDesktopApp.exe.1413653332") Found string "RaiseException" (Indicator: "RaiseException"; in File: "3CXDesktopApp.exe.1413653332") Found string "RemoveDirectoryW" (Indicator: "RemoveDirectoryW"; in File: "3CXDesktopApp.exe.1413653332") Found string "RtlUnwind" (Indicator: "RtlUnwind"; in File: "3CXDesktopApp.exe.1413653332") Found string "SetFileAttributesW" (Indicator: "SetFileAttributesW"; in File: "3CXDesktopApp.exe.1413653332") Found string "SetFilePointerEx" (Indicator: "SetFilePointer"; in File: "3CXDesktopApp.exe.1413653332") Found string "SetLastError" (Indicator: "SetLastError"; in File: "3CXDesktopApp.exe.1413653332") Found string "SetStdHandle" (Indicator: "SetStdHandle"; in File: "3CXDesktopApp.exe.1413653332") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; in File: "3CXDesktopApp.exe.1413653332") Found string "TerminateProcess" (Indicator: "TerminateProcess"; in File: "3CXDesktopApp.exe.1413653332") Found string "TlsAlloc" (Indicator: "TlsAlloc"; in File: "3CXDesktopApp.exe.1413653332") Found string "TlsFree" (Indicator: "TlsFree"; in File: "3CXDesktopApp.exe.1413653332") Found string "TlsGetValue" (Indicator: "TlsGetValue"; in File: "3CXDesktopApp.exe.1413653332") Found string "TlsSetValue" (Indicator: "TlsSetValue"; in File: "3CXDesktopApp.exe.1413653332") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; in File: "3CXDesktopApp.exe.1413653332") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in File: "3CXDesktopApp.exe.1413653332") Found string "WriteConsoleW" (Indicator: "WriteConsoleW"; in File: "3CXDesktopApp.exe.1413653332") Found string "WriteFile" (Indicator: "WriteFile"; in File: "3CXDesktopApp.exe.1413653332") Found string "OpenProcessToken failed with %d" (Indicator: "OpenProcess"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "ServerMain (CA): CoInitializeSecurity failed" (Indicator: "CoInitialize"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "ServiceThreadMain: CoInitializeSecurity failed" (Indicator: "CoInitialize"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "ServiceThreadMain: CreateSD for CreateWaitableTimer failed." (Indicator: "CreateWaitableTimer"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "ServiceThreadMain: CreateWaitableTimer failed." (Indicator: "CreateWaitableTimer"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "ServiceThreadMain: SetWaitableTimer failed." (Indicator: "SetWaitableTimer"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CoInitializeEx" (Indicator: "CoInitialize"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CoInitializeSecurity" (Indicator: "CoInitialize"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CreateWaitableTimerW" (Indicator: "CreateWaitableTimer"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetWaitableTimer" (Indicator: "SetWaitableTimer"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetSystemWow64DirectoryW" (Indicator: "GetSystemWow64DirectoryW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetTokenInformation" (Indicator: "GetTokenInformation"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "OpenThreadToken" (Indicator: "OpenThread"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetLengthSid" (Indicator: "GetLength"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RegOpenKeyExW" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "InitializeAcl" (Indicator: "InitializeAcl"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetThreadToken" (Indicator: "SetThreadToken"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "FreeSid" (Indicator: "FreeSid"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RegSetValueExW" (Indicator: "RegSetValueExW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RegCreateKeyExW" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "EqualSid" (Indicator: "EqualSid"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetAce" (Indicator: "GetAce"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RegEnumKeyW" (Indicator: "RegEnumKeyW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RevertToSelf" (Indicator: "RevertToSelf"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValueW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CompareStringW" (Indicator: "CompareStringW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetLastError" (Indicator: "SetLastError"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "EnterCriticalSection" (Indicator: "EnterCriticalSection"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLineW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "lstrlenW" (Indicator: "lstrlenW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetModuleHandleExW" (Indicator: "GetModuleHandleExW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetModuleFileNameW" (Indicator: "GetModuleFileNameW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "LeaveCriticalSection" (Indicator: "LeaveCriticalSection"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "InitializeCriticalSection" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariableW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetVersionExW" (Indicator: "GetVersion"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangI"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetACP" (Indicator: "GetACP"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetVersion" (Indicator: "GetVersion"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CreateEventW" (Indicator: "CreateEventW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "FormatMessageW" (Indicator: "FormatMessageW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "OutputDebugStringW" (Indicator: "OutputDebugStringW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetCurrentThread" (Indicator: "GetCurrentThread"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GlobalFree" (Indicator: "GlobalFree"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "LoadLibraryW" (Indicator: "LoadLibraryW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CreateThread" (Indicator: "CreateThread"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetCurrentDirectoryW" (Indicator: "etCurrentDirectoryW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "DeleteCriticalSection" (Indicator: "DeleteCriticalSection"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetModuleHandleW" (Indicator: "GetModuleHandleW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetFileType" (Indicator: "GetFileType"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "lstrcmpW" (Indicator: "lstrcmpW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetSystemDirectoryW" (Indicator: "GetSystemDirectoryW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "PostQuitMessage" (Indicator: "PostQuitMessage"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "TranslateMessage" (Indicator: "TranslateMessage"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "PeekMessageW" (Indicator: "PeekMessageW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "DispatchMessageW" (Indicator: "DispatchMessageW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "MsgWaitForMultipleObjects" (Indicator: "MsgWaitForMultipleObjects"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RtlCaptureContext" (Indicator: "RtlCaptureContext"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RtlLookupFunctionEntry" (Indicator: "RtlLookupFunctionEntry"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "RtlVirtualUnwind" (Indicator: "RtlVirtualUnwind"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CoInitialize" (Indicator: "CoInitialize"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "CoUninitialize" (Indicator: "CoUninitialize"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetStartupInfoW" (Indicator: "GetStartupInfoW"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "TerminateProcess" (Indicator: "TerminateProcess"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "LoadLibraryExA" (Indicator: "LoadLibraryExA"; in Source: "00000000-00006048.00000000.78917.3432A000.00000002.mdmp, 00000000-00006048.00000001.80839.3432A000.00000002.mdmp") Found string "" (Indicator: "RegDeleteKeyA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegDeleteKeyW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "AccessCheck"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "CopyFileA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "CopyFileW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "CopyFileExA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "CreateFileA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "CreateFileW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "DeleteFileA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "DeleteFileW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "MoveFile"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "MoveFile"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "MoveFile"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "MoveFile"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "SetFileAttributesA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "SetFileAttributesW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegCreateKeyA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegCreateKeyW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegCreateKeyExA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegOpenKeyExA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegSetValueExA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegSetValueExW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegDeleteValueA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "RegDeleteValueW"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "SetFileSecurityA"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "GetVersion"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "GetVersion"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "GetVersion"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "" (Indicator: "GetVersion"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "GetVersion"; in Source: "00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "__SetUninstallDisplayVersionPermissions65" (Indicator: "DisplayVersion"; in Source: "00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "74162672267,3008,3140,,CreateCompatibleBitmap,Gdi32.dll,"00:20:59.406",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; in Source: "00000000-00006048.00000001.80839.B9550000.00000004.mdmp") Found string "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\DisplayVersion" (Indicator: "DisplayVersion"; in Source: "00000000-00006048.00000001.80839.BBF90000.00000004.mdmp") Found string "DisplayVersion" (Indicator: "DisplayVersion"; in Source: "00000000-00006048.00000001.80839.BBF90000.00000004.mdmp") Found string "_UninstallDisplayVersion65" (Indicator: "DisplayVersion"; in Source: "00000000-00006048.00000001.80839.BBF90000.00000004.mdmp") Found string "UninstallDisplayVersion" (Indicator: "DisplayVersion"; in Source: "00000000-00006048.00000001.80839.BBF90000.00000004.mdmp") Found string "SetUninstallDisplayVersionPermissions" (Indicator: "DisplayVersion"; in Source: "00000000-00006048.00000001.80839.BBF90000.00000004.mdmp") Found string "__UninstallDisplayVersion65" (Indicator: "DisplayVersion"; in Source: "00000000-00006048.00000001.80839.BBF90000.00000004.mdmp") Found string "83087849940,3008,3140,,CreateCompatibleBitmap,Gdi32.dll,"00:21:03.125",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; in Source: "00000000-00006048.00000001.80839.BBF90000.00000004.mdmp") Found string "OpenProcessToken failed with %d" (Indicator: "OpenProcess"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "ServerMain (CA): CoInitializeSecurity failed" (Indicator: "CoInitialize"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "ServiceThreadMain: CoInitializeSecurity failed" (Indicator: "CoInitialize"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "ServiceThreadMain: CreateSD for CreateWaitableTimer failed." (Indicator: "CreateWaitableTimer"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "ServiceThreadMain: CreateWaitableTimer failed." (Indicator: "CreateWaitableTimer"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "ServiceThreadMain: SetWaitableTimer failed." (Indicator: "SetWaitableTimer"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CoInitializeEx" (Indicator: "CoInitialize"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CoInitializeSecurity" (Indicator: "CoInitialize"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CreateWaitableTimerW" (Indicator: "CreateWaitableTimer"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetWaitableTimer" (Indicator: "SetWaitableTimer"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetSystemWow64DirectoryW" (Indicator: "GetSystemWow64DirectoryW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetTokenInformation" (Indicator: "GetTokenInformation"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "OpenThreadToken" (Indicator: "OpenThread"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetLengthSid" (Indicator: "GetLength"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RegOpenKeyExW" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "InitializeAcl" (Indicator: "InitializeAcl"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetThreadToken" (Indicator: "SetThreadToken"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "FreeSid" (Indicator: "FreeSid"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RegSetValueExW" (Indicator: "RegSetValueExW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RegCreateKeyExW" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "EqualSid" (Indicator: "EqualSid"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetAce" (Indicator: "GetAce"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RegEnumKeyW" (Indicator: "RegEnumKeyW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RevertToSelf" (Indicator: "RevertToSelf"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValueW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.429DA000.00000004.mdmp") Found string "CompareStringW" (Indicator: "CompareStringW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetLastError" (Indicator: "SetLastError"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "EnterCriticalSection" (Indicator: "EnterCriticalSection"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLineW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "lstrlenW" (Indicator: "lstrlenW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetModuleHandleExW" (Indicator: "GetModuleHandleExW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetModuleFileNameW" (Indicator: "GetModuleFileNameW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "LeaveCriticalSection" (Indicator: "LeaveCriticalSection"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "InitializeCriticalSection" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariableW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetVersionExW" (Indicator: "GetVersion"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangI"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetACP" (Indicator: "GetACP"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetVersion" (Indicator: "GetVersion"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CreateEventW" (Indicator: "CreateEventW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "FormatMessageW" (Indicator: "FormatMessageW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "OutputDebugStringW" (Indicator: "OutputDebugStringW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetCurrentThread" (Indicator: "GetCurrentThread"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GlobalFree" (Indicator: "GlobalFree"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "LoadLibraryW" (Indicator: "LoadLibraryW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CreateThread" (Indicator: "CreateThread"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetCurrentDirectoryW" (Indicator: "etCurrentDirectoryW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "DeleteCriticalSection" (Indicator: "DeleteCriticalSection"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetModuleHandleW" (Indicator: "GetModuleHandleW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetFileType" (Indicator: "GetFileType"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "lstrcmpW" (Indicator: "lstrcmpW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetSystemDirectoryW" (Indicator: "GetSystemDirectoryW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "PostQuitMessage" (Indicator: "PostQuitMessage"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "TranslateMessage" (Indicator: "TranslateMessage"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "PeekMessageW" (Indicator: "PeekMessageW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "DispatchMessageW" (Indicator: "DispatchMessageW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "MsgWaitForMultipleObjects" (Indicator: "MsgWaitForMultipleObjects"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RtlCaptureContext" (Indicator: "RtlCaptureContext"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RtlLookupFunctionEntry" (Indicator: "RtlLookupFunctionEntry"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "RtlVirtualUnwind" (Indicator: "RtlVirtualUnwind"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CoInitialize" (Indicator: "CoInitialize"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "CoUninitialize" (Indicator: "CoUninitialize"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetStartupInfoW" (Indicator: "GetStartupInfoW"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "TerminateProcess" (Indicator: "TerminateProcess"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "LoadLibraryExA" (Indicator: "LoadLibraryExA"; in Source: "00000000-00006456.00000000.79169.3432A000.00000002.mdmp, 00000000-00006456.00000001.81089.3432A000.00000002.mdmp, 00000000-00006456.00000002.83010.3432A000.00000002.mdmp") Found string "UninstallDisplayVersion" (Indicator: "DisplayVersion"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3448D000.00000004.mdmp, 00000000-00006456.00000002.83010.42990000.00000004.mdmp") Found string "" (Indicator: "RegDeleteKeyA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegDeleteKeyW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "AccessCheck"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "CopyFileA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "CopyFileW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "CopyFileExA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "CreateFileA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "CreateFileW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "DeleteFileA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "DeleteFileW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "MoveFile"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "MoveFile"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "MoveFile"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "MoveFile"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "SetFileAttributesA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "SetFileAttributesW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegCreateKeyA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegCreateKeyW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegCreateKeyExA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegOpenKeyExA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegSetValueExA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegSetValueExW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegDeleteValueA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "RegDeleteValueW"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "SetFileSecurityA"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "GetVersion"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "GetVersion"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "GetVersion"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "" (Indicator: "GetVersion"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "GetVersion"; in Source: "00000000-00006456.00000000.79169.34420000.00000004.mdmp, 00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "DisplayVersion" (Indicator: "DisplayVersion"; in Source: "00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.344B6000.00000004.mdmp") Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00006456.00000001.81089.3CA80000.00000004.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp") Found string "FlsSetValue" (Indicator: "FlsSetValue"; in Source: "00000000-00006456.00000001.81089.3CA80000.00000004.mdmp, 00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp") Found string "83243361240,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:07.015",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000001.81089.3CA80000.00000004.mdmp, 00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp") Found string "82895193334,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:06.875",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000001.81089.3CA80000.00000004.mdmp") Found string "83133571374,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:06.968",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000001.81089.3CA80000.00000004.mdmp") Found string "83143586562,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:06.968",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000001.81089.3CA80000.00000004.mdmp") Found string "83276029381,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:07.031",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000001.81089.3CA80000.00000004.mdmp") Found string "83195120774,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:07.000",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000001.81089.3CA80000.00000004.mdmp") Found string "__UninstallDisplayVersion65" (Indicator: "DisplayVersion"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.42990000.00000004.mdmp") Found string "__SetUninstallDisplayVersionPermissions65" (Indicator: "DisplayVersion"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.42990000.00000004.mdmp") Found string "SetUninstallDisplayVersionPermissions" (Indicator: "DisplayVersion"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.42990000.00000004.mdmp") Found string "SetEntriesInAclW" (Indicator: "SetEntriesInAclW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.429DA000.00000004.mdmp") Found string "CloseServiceHandle" (Indicator: "CloseServiceHandle"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp, 00000000-00006456.00000002.83010.429DA000.00000004.mdmp") Found string "HeapSize" (Indicator: "HeapSize"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "InitializeCriticalSectionEx" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "CorExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "LocaleNameToLCID" (Indicator: "LocaleNameToLCID"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "ConvertStringSecurityDescriptorToSecurityDescriptorW" (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "SetNamedSecurityInfoW" (Indicator: "SetNamedSecurityInfoW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "LookupAccountNameW" (Indicator: "LookupAccountNameW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "RegDeleteKeyW" (Indicator: "RegDeleteKeyW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "RegDeleteValueW" (Indicator: "RegDeleteValueW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "RegEnumKeyExW" (Indicator: "RegEnumKeyExW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "RegEnumValueW" (Indicator: "RegEnumValueW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKeyW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "LocalFree" (Indicator: "LocalFree"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "CreateFileW" (Indicator: "CreateFileW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "LCMapStringW" (Indicator: "LCMapStringW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "HeapAlloc" (Indicator: "HeapAlloc"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "HeapReAlloc" (Indicator: "HeapReAlloc"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "HeapFree" (Indicator: "HeapFree"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetProcessHeap" (Indicator: "GetProcessHeap"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "SetFilePointerEx" (Indicator: "SetFilePointer"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GlobalDeleteAtom" (Indicator: "GlobalDeleteAtom"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GlobalAddAtomW" (Indicator: "GlobalAddAtomW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GlobalFindAtomW" (Indicator: "GlobalFindAtomW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "FlushFileBuffers" (Indicator: "FlushFileBuffers"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "IsProcessorFeaturePresent" (Indicator: "IsProcessorFeaturePresent"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "InitializeSListHead" (Indicator: "InitializeSListHead"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "RtlUnwindEx" (Indicator: "RtlUnwind"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "InitializeCriticalSectionAndSpinCount" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "TlsAlloc" (Indicator: "TlsAlloc"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "TlsGetValue" (Indicator: "TlsGetValue"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "TlsSetValue" (Indicator: "TlsSetValue"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "TlsFree" (Indicator: "TlsFree"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "RaiseException" (Indicator: "RaiseException"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetStringTypeW" (Indicator: "GetStringTypeW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "FindFirstFileExA" (Indicator: "FindFirstFileExA"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "FindNextFileA" (Indicator: "FindNextFileA"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "IsValidCodePage" (Indicator: "IsValidCodePage"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetOEMCP" (Indicator: "GetOEMCP"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetCPInfo" (Indicator: "GetCPInfo"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "SetStdHandle" (Indicator: "SetStdHandle"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetConsoleCP" (Indicator: "GetConsoleCP"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "WriteConsoleW" (Indicator: "WriteConsoleW"; in Source: "00000000-00006456.00000001.81089.42970000.00000004.mdmp") Found string "PRINT,NS_WRPRegDeleteKey::APIHook_RegDeleteKeyW,452,[ApiName] Hook Entered" (Indicator: "RegDeleteKeyW"; in Source: "00000000-00006456.00000002.83010.34420000.00000004.mdmp") Found string "87512989343,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:08.796",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp") Found string "87415301482,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:08.750",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp") Found string "87419959710,7152,3143,,AdjustTokenPrivileges,advapi32.dll,"00:21:08.750",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp") Found string "91677673749,5916,3025,,RtlGetNtProductType,NTDLL.dll,"00:21:10.531",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; in Source: "00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp") Found string "87440699047,7152,3123,,RemoveDirectoryW,kernel32.dll,"00:21:08.765",RX=0,PX=0" (Indicator: "RemoveDirectoryW"; in Source: "00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp") Found string "HeapSizeK" (Indicator: "HeapSize"; in Source: "00000000-00006456.00000002.83010.429DA000.00000004.mdmp")33:T475,"msiexec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 56500000 "msiexec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 56500000 "msiexec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 56500000 "msiexec.exe" loaded module "KERNEL32" at base 59dd0000 "msiexec.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 4f580000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\TSAPPCMP.DLL" at base 0 "msiexec.exe" loaded module "NTDLL.DLL" at base 59f50000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 58f30000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 58b50000 "msiexec.exe" loaded module "COMCTL32" at base 432f0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 59dd0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 548e0000 "msiexec.exe" loaded module "COMCTL32.DLL" at base 432f0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 59500000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 57420000 "msiexec.exe" loaded module "SHELL32.DLL" at base 5742000034:T9f4,"msiexec.exe" touched "Window Property Store" (Path: "HKCU\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\INSTANCE") "msiexec.exe" touched "Msi install server" (Path: "HKCU\CLSID\{000C101C-0000-0000-C000-000000000046}") "msiexec.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{000C103E-0000-0000-C000-000000000046}") "msiexec.exe" touched "SPP Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}") "msiexec.exe" touched "Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "msiexec.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "msiexec.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\INPROCSERVER32") "msiexec.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "msiexec.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "msiexec.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "msiexec.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "msiexec.exe" touched "Sync root manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "msiexec.exe" touched "ShellItem Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "MsiExec.exe" touched "HNetCfg.FwPolicy2" (Path: "HKCU\WOW6432NODE\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}") "MsiExec.exe" touched "HNetCfg.FwRule" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}") "MsiExec.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "MsiExec.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "MsiExec.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "3CXDesktopApp.exe" touched "Microsoft Spell Checker Factory Class" (Path: "HKCU\CLSID\{7AB36653-1796-484B-BDFA-E74F1DB7C1DC}") "3CXDesktopApp.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS")35:T61b,Process "msiexec.exe" (UID: 00000000-00006456) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00006456) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00004236) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LnfhLnwA="C:\Users\%OSUSER%", LOGONSERVER="\\DESKTOP-FVVF82A", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\erRVvNT", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00004236) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP" Process "3CXDesktopApp.exe" (UID: 00000000-00004940) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "3CXDesktopApp.exe" (UID: 00000000-00004940) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "reg.exe" (UID: 00000000-00002708) was launched with new environment variables: "ORIGINAL_XDG_CURRENT_DESKTOP="undefined"" Process "reg.exe" (UID: 00000000-00002708) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "reg.exe" (UID: 00000000-00002708) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"36:T728,"msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ".") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "..") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "0409") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ADVANCEDINSTALLERS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPLOCKER") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPMGMT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPRAISER") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPV") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BOOT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BTHPROPS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT2") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CODEINTEGRITY") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "COM") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIG") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIGURATION") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DDFS")37:T65c,Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00006456) Spawned process "MsiExec.exe" with commandline "-Embedding E2E52B8FA57D16C914D60CC454931D1A" (UID: 00000000-00004236) Spawned process "MsiExec.exe" with commandline "-Embedding 08ED0AC967CF009FECA3900309E3A85C" (UID: 00000000-00002944) Spawned process "3CXDesktopApp.exe" (UID: 00000000-00004940) Spawned process "3CXDesktopApp.exe" (UID: 00000000-00004976) Spawned process "reg.exe" with commandline "QUERY HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ..." (UID: 00000000-00002708) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --gpu-preferences=UAAAAAAAAADgAAAYAAA ..." (UID: 00000000-00006328) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00002244) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00003800) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00004960) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00006380) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00006872) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --gpu-preferences=UAAAAAAAAADoAAAYAAA ..." (UID: 00000000-00002596)38:T65c,Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00006456) Spawned process "MsiExec.exe" with commandline "-Embedding E2E52B8FA57D16C914D60CC454931D1A" (UID: 00000000-00004236) Spawned process "MsiExec.exe" with commandline "-Embedding 08ED0AC967CF009FECA3900309E3A85C" (UID: 00000000-00002944) Spawned process "3CXDesktopApp.exe" (UID: 00000000-00004940) Spawned process "3CXDesktopApp.exe" (UID: 00000000-00004976) Spawned process "reg.exe" with commandline "QUERY HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ..." (UID: 00000000-00002708) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --gpu-preferences=UAAAAAAAAADgAAAYAAA ..." (UID: 00000000-00006328) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00002244) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00003800) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00004960) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00006380) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-san ..." (UID: 00000000-00006872) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --gpu-preferences=UAAAAAAAAADoAAAYAAA ..." (UID: 00000000-00002596)39:Tced,"Update.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\Update.exe]- [targetUID: 00000000-00004976] "v8_context_snapshot.bin" has type "data"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\v8_context_snapshot.bin]- [targetUID: 00000000-00003800] "libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\libEGL.dll]- [targetUID: 00000000-00006328] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\ffmpeg.dll]- [targetUID: 00000000-00003800] "3CX Desktop App.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Fri Mar 3 21:21:46 2023 mtime=Wed Mar 29 21:02:13 2023 atime=Fri Mar 3 21:21:46 2023 length=554240 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\3CX Ltd\3CX Desktop App.lnk]- [targetUID: 00000000-00004976] "3CXDesktopApp.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\3CXDesktopApp.exe]- [targetUID: 00000000-00004976] "vk_swiftshader.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\vk_swiftshader.dll]- [targetUID: 00000000-00006328] "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\d3dcompiler_47.dll]- [targetUID: 00000000-00004976] "vulkan-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\vulkan-1.dll]- [targetUID: 00000000-00006328] "snapshot_blob.bin" has type "data"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\snapshot_blob.bin]- [targetUID: 00000000-00002944] "ca.pak" has type "data"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\locales\ca.pak]- [targetUID: 00000000-00002944] "ja.pak" has type "data"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\locales\ja.pak]- [targetUID: 00000000-00002944] "60a7a59e-0e00-4eaf-8e0c-c54135336c99.tmp" has type "ASCII text with no line terminators"- Location: [%APPDATA%\3CXDesktopApp\Network\60a7a59e-0e00-4eaf-8e0c-c54135336c99.tmp]- [targetUID: 00000000-00002244] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\3CXDesktopApp\Local Storage\leveldb\000001.dbtmp]- [targetUID: 00000000-00004976] "MSI5C46.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI5C46.tmp]- [targetUID: 00000000-00006456] "bg.pak" has type "data"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\locales\bg.pak]- [targetUID: 00000000-00002944] "07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17]- [targetUID: 00000000-00006456] "et.pak" has type "data"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app-18.12.407\locales\et.pak]- [targetUID: 00000000-00006456]3a:T4da,"msiexec.exe" touched file "C:\Windows\Fonts" "msiexec.exe" touched file "C:\Windows\Installer\12d866.msi" "msiexec.exe" touched file "C:\Windows\Installer\MSIED08.tmp" "msiexec.exe" touched file "C:\Windows\Installer\inprogressinstallinfo.ipi" "msiexec.exe" touched file "C:\Windows\Temp\~DF75561AF2F5B66F5F.TMP" "msiexec.exe" touched file "C:\Windows\Installer\SourceHash{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}" "msiexec.exe" touched file "C:\Windows\Temp\~DF349A94197F7AF9A5.TMP" "msiexec.exe" touched file "C:\Windows\Installer\MSIFBAF.tmp" "msiexec.exe" touched file "C:\Windows\Installer\MSIFCE8.tmp" "msiexec.exe" touched file "C:\Windows\Installer\MSI258.tmp" "msiexec.exe" touched file "C:\Windows\Installer\MSI68F.tmp" "msiexec.exe" touched file "C:\Windows\Installer\MSI99D.tmp" "msiexec.exe" touched file "C:\Windows\Temp\~DFD49AE082A92C8014.TMP" "msiexec.exe" touched file "C:\Windows\Temp\~DFF8325517931857C3.TMP" "msiexec.exe" touched file "C:\Windows\Installer\MSI319A.tmp" "msiexec.exe" touched file "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches" "msiexec.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\3CX Ltd\3CX Desktop App.lnk"3b:T846,"msiexec.exe" trying to access non-existent file "C:\Windows\System32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "MsiExec.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "MsiExec.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\FLTLIB.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\DBGHELP.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\UIAUTOMATIONCORE.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\MSIMG32.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\WINMM.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\WINMMBASE.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\IPHLPAPI.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\VERSION.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\USERENV.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\DWRITE.DLL" "3CXDesktopApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\SECUR32.DLL"3c:T9c3,"msiexec.exe" trying to access non-existent file "C:\Windows\System32\MSIEXEC.EXE.LOCAL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_7748C7B8425C0E790E793F74FDC7F892" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3538626A1FCCCA43C7E18F220BDD9B02" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_5453925CF1FC5AEA2F776AD35FF4432C" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_514259E571FE76259BCED6780D7CC199" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E6286BA49003BA567AB6681F1333DB4" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_480C858474EF9C8E5CC1EA7749803D46" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_317EEB94F6A66673CB33376C05811D7C" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2"3d:T23bd,Heuristic match: "2_.Ng" Heuristic match: "3CXDesktopApp.tel" Heuristic match: "[=.ck" Heuristic match: "dP.ug" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ5suEceKjAJbxseAmHFkQ9FrhTWQQUDuE6qFM6MdWKvsG7rWcaA4WtNA4CEBtmEd%2Bcmk1uzI7VDJuReHM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Heuristic match: "ocsp.sectigo.com" Heuristic match: "r/.KH" Heuristic match: "yXa.ps" Pattern match: "https://dns.google,supports_spdy:true}],version:5},network_qualities:{CAESABiAgICA+P////8B:4G" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "ocsp.comodoca.com.cdn.cloudflare.net" Heuristic match: "fp2e7a.wpc.phicdn.net" Heuristic match: "ocsp.digicert.com" Heuristic match: "ocsp.usertrust.com" Pattern match: "ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEB2iSDBvmyYY0ILgln0z02o%3D" Heuristic match: "csp.digicert.com" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl" Pattern match: "http://ocsp.usertrust.com" Pattern match: "http://ocsp.digicert.com" Pattern match: "http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl" Heuristic match: "csp.usertrust.com" Pattern match: "http://crl3.digicert.com/DigiCertTrustedRootG4.crl" Pattern match: "http://ocsp.sectigo.com" Pattern match: "http://crl.sectigo.com/SectigoRSACodeSigningCA.crl" Pattern match: "http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "https://sectigo.com/CPS0" Pattern match: "crl.sectigo.com/Sect" Pattern match: "crt.sectigo.com/SectigoRSACodeSigningCA.crt0#" Pattern match: "http://crl.usertrust.com/USERTrustRSACertification" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp" Pattern match: "gicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0" Pattern match: "http://ocsp.digi" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "crl3.digicert.com/DigiCertTrustedRootG4.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl.sectigo.com/SectigoRSACodeSigningCA.crl0s" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.mic" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Heuristic match: "Host: ocsp.digicert.com" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "www.digic" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "0www.entrust.net/CPS" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "http://o0" Pattern match: "http://repository.swisssign.com/0" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CM" Pattern match: "crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0" Pattern match: "http://ocsp.digicert.com0X" Pattern match: "t.com/Di" Heuristic match: "ntrust.net" Pattern match: "http://wwwp.digicert.com/" Pattern match: "ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAc2N7ckVHzYR6z9KGYqXls%3D" Pattern match: "http://cacerts.digicert.com/DigiCertTrustedRootG4.crt" Pattern match: "ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTjzY2p9Pa8oibmj%2BNSMWsz63kmWgQUuhbZbU2FL3MpdpovdYxqII%2BeyG8CEAxNaXJLlPo8Kko9KQeAPVo%3D" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com/windows0" Heuristic match: "o.com" Pattern match: "http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://sf.symcb.com/sf.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "crl3.digicert.com/DigiCertTrustedRootG4.crl" Pattern match: "cacerts.digicert.com/Di" Heuristic match: "System.AppUserModel.ID" Heuristic match: "SOFTWARE\Classes\3CXDesktopApp.tel" Heuristic match: "ystem.ActivityHistory.Id" Heuristic match: "ystem.AppUserModel.ID" Heuristic match: "ystem.IdentityProvider.Name" Heuristic match: "ystem.Protocol.Name" Heuristic match: "ystem.SAM.Name" Heuristic match: "ystem.StructuredQuery.Is" Heuristic match: "ystem.StructuredQuery.Virtual.Cc" Heuristic match: "ystem.StructuredQuery.Virtual.To" Heuristic match: "C:\Users\erRVvNT\AppData\Local\Programs\3CXDesktopApp\app-18.12.407\resources\app.as" Heuristic match: "HEXT=.CO" Pattern match: "http://wixtoolset.org" Pattern match: "http://crl3.digicert.com/sha2-assured-ts.crl02" Pattern match: "http://crl4.digicert.com/sha2-assured-ts.crl0" Pattern match: "http://ocsp.digicert.com0O" Pattern match: "http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E" Pattern match: "http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L" Pattern match: "http://ocsp.digicert.com0N" Pattern match: "cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0" Pattern match: "www.digicert.com110/" Pattern match: "cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P" Heuristic match: "System.ActivityHistory.Id" Heuristic match: "System.IdentityProvider.Name" Heuristic match: "System.SAM.Name" Heuristic match: "System.StructuredQuery.Virtual.Cc" Heuristic match: "System.StructuredQuery.Virtual.To" Heuristic match: "System.StructuredQuery.Is" Heuristic match: "System.Protocol.Name" Heuristic match: "System.StructuredQueryType.Implicit.Is"3e:T428,YARA signature for RC4 encryption matched on process "00000000-00006456" YARA signature for RC4 encryption matched on file "MSI258.tmp" YARA signature for RC4 encryption matched on file "MSI319A.tmp" YARA signature for RC4 encryption matched on file "MSI68F.tmp" YARA signature for RC4 encryption matched on file "sample.bin" YARA signature for RC4 encryption matched on file "robotjs.node" YARA signature for RC4 encryption matched on file "vk_swiftshader.dll" YARA signature for RC4 encryption matched on file "ffmpeg.dll" YARA signature for RC4 encryption matched on file "vulkan-1.dll" YARA signature for RC4 encryption matched on file "MSIFBAF.tmp" YARA signature for RC4 encryption matched on file "d3dcompiler_47.dll" YARA signature for RC4 encryption matched on file "MSIED08.tmp" YARA signature for RC4 encryption matched on file "MSI5C46.tmp" YARA signature for RC4 encryption matched on file "3CXDesktopApp.exe" YARA signature for RC4 encryption matched on file "MSI99D.tmp" YARA signature for RC4 encryption matched on file "MSI4E4A.tmp"3f:T83f,"msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006048) "msiexec.exe" called "FindFirstFileW" with parameter C:\aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868.msi (UID: 00000000-00006048) "msiexec.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\3CX Ltd.\ (UID: 00000000-00006048) "msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006456) "msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006456) "msiexec.exe" called "FindFirstFileW" with parameter C:\aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868.msi (UID: 00000000-00006456) "msiexec.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\3CX Ltd.\ (UID: 00000000-00006456) "msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Installer\$PatchCache$\Managed\*.* (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter 000041091A0090400100000000F01FEC (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter 00004109340000000100000000F01FEC (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter 00004109340090400100000000F01FEC (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter 00004109440090400100000000F01FEC (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter 00004109511090400100000000F01FEC (UID: 00000000-00006456) "msiexec.exe" called "FindNextFileW" with parameter 00004109610090400100000000F01FEC (UID: 00000000-00006456)40:T1249,"21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\DisplayIcon" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456-00000BC1-92657002 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\DisplayName" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456-00000BC1-92624530 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\DisplayVersion" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456-00000BC1-92638629 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\InstallPath" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456-00000BC1-92618426 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\ModifyPath" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456-00000BC1-92645808 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\Publisher" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456-00000BC1-92631801 "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\UninstallString" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456-00000BC1-92651286 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006048.00000001.80839.BBF90000.00000004.mdmp "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\DisplayVersion" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006048.00000001.80839.BBF90000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006048.00000001.80839.BBF90000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000000.79169.344B2000.00000004.mdmp 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp 00000000-00006456.00000001.81089.42970000.00000004.mdmp 00000000-00006456.00000002.83010.42990000.00000004.mdmp "oftware\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp "21:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq\InstallPath" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp 00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp "CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp 00000000-00006456.00000002.83010.3CAA8000.00000004.mdmp "oftware\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp "\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp "RE\Microsoft\Windows\CurrentVersion\Uninstall\{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}.msq" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006456.00000001.81089.3CA80000.00000004.mdmp41:T8c5,"msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")42:T825,Dropped file: "3CX Desktop App.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\3CX Ltd\3CX Desktop App.lnk]- [targetUID: 00000000-00004976] Dropped file: "60a7a59e-0e00-4eaf-8e0c-c54135336c99.tmp" - Location: [%APPDATA%\3CXDesktopApp\Network\60a7a59e-0e00-4eaf-8e0c-c54135336c99.tmp]- [targetUID: 00000000-00002244] Dropped file: "000001.dbtmp" - Location: [%APPDATA%\3CXDesktopApp\Local Storage\leveldb\000001.dbtmp]- [targetUID: 00000000-00004976] Dropped file: "data_1" - Location: [%APPDATA%\3CXDesktopApp\Cache\Cache_Data\data_1]- [targetUID: 00000000-00004976] Dropped file: "000003.log" - Location: [%APPDATA%\3CXDesktopApp\Local Storage\leveldb\000003.log]- [targetUID: 00000000-00004976] Dropped file: "index" - Location: [%APPDATA%\3CXDesktopApp\Cache\Cache_Data\index]- [targetUID: 00000000-00004976] Dropped file: "data_3" - Location: [%APPDATA%\3CXDesktopApp\Cache\Cache_Data\data_3]- [targetUID: 00000000-00004976] Dropped file: "~CX Desktop App.tmp" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\3CX Ltd\~CX Desktop App.tmp]- [targetUID: 00000000-00006456] Dropped file: "data_2" - Location: [%APPDATA%\3CXDesktopApp\Cache\Cache_Data\data_2]- [targetUID: 00000000-00004976] Dropped file: "temp-index" - Location: [%APPDATA%\3CXDesktopApp\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00004976] Dropped file: "main.log" - Location: [%APPDATA%\3CXDesktopApp\logs\main.log]- [targetUID: 00000000-00004976] Dropped file: "MANIFEST-000001" - Location: [%APPDATA%\3CXDesktopApp\Local Storage\leveldb\MANIFEST-000001]- [targetUID: 00000000-00004976] Dropped file: "Cookies" - Location: [%APPDATA%\3CXDesktopApp\Network\Cookies]- [targetUID: 00000000-00002244] Dropped file: "a2072310-fd28-4d29-9390-3cfe5bf8e330.tmp" - Location: [%APPDATA%\3CXDesktopApp\a2072310-fd28-4d29-9390-3cfe5bf8e330.tmp]- [targetUID: 00000000-00004976] Dropped file: "8f53be0a-bc0a-4362-a526-af8ab2f5807e.tmp" - Location: [%APPDATA%\3CXDesktopApp\Network\8f53be0a-bc0a-4362-a526-af8ab2f5807e.tmp]- [targetUID: 00000000-00002244]43:T452,"3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00004940-00000C13-114751102 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00004940-00000C13-114752375 "reg.exe" queried SystemProcessInformation at 00000000-00002708-00000C13-137238171 "reg.exe" queried SystemProcessInformation at 00000000-00002708-00000C13-137239794 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00002244-00000C13-163806818 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00002244-00000C13-163808010 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00006872-00000C13-223512660 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00006872-00000C13-223513838 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00002596-00000C13-265655964 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00002596-00000C13-265657078 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00002596-00000C13-266032186 "3CXDesktopApp.exe" queried SystemProcessInformation at 00000000-00002596-00000C13-26603325644:T64d,"Update.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\Update.exe]- [targetUID: 00000000-00004976] "libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\libEGL.dll]- [targetUID: 00000000-00006328] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\ffmpeg.dll]- [targetUID: 00000000-00003800] "3CXDesktopApp.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\3CXDesktopApp.exe]- [targetUID: 00000000-00004976] "vk_swiftshader.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\vk_swiftshader.dll]- [targetUID: 00000000-00006328] "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\d3dcompiler_47.dll]- [targetUID: 00000000-00004976] "vulkan-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\3CXDesktopApp\app\vulkan-1.dll]- [targetUID: 00000000-00006328] "MSI5C46.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI5C46.tmp]- [targetUID: 00000000-00006456] "MSI258.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI258.tmp]- [targetUID: 00000000-00006456]45:T594,Potential IP "4.0.0.0" found in string "version="4.0.0.0"" Potential IP "6.0.0.0" found in string "version="6.0.0.0"" Potential IP "4.0.0.0" found in string "MSIExec,processorArchitecture="amd64",type="win32",version="4.0.0.0"C:\WINDOWS\System32\msiexec.exe" Potential IP "5.1.0.0" found in string "Microsoft.Windows.Installer.Engine,processorArchitecture="*",type="win32",version="5.1.0.0"C:\Windows\System32\msi.dll" Potential IP "5.1.0.0" found in string "Microsoft.Windows.Shell.shell32,processorArchitecture="*",type="win32",version="5.1.0.0"C:\WINDOWS\WindowsShell.Manifest" "192.168.242.80" "2.5.29.15" "2.5.29.17" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.32" "2.5.29.31" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.19" "2.5.4.17" "2.5.29.1" "2.5.4.9" "2.5.4.11" "2.5.29.10" "2.5.4.3" "2.5.29.16" "2.5.4.8" "2.5.4.6" "2.5.4.10" "2.5.4.7" "5.0.0.1" "2.0.0.0" Potential IP "5.1.0.0" found in string "Microsoft.Windows.Installer.Handler,processorArchitecture="amd64",type="win32",version="5.1.0.0"C:\WINDOWS\System32\MsiHnd.dll" Potential IP "4.0.0.0" found in string "MSIExec,processorArchitecture="amd64",type="win32",version="4.0.0.0"C:\WINDOWS\system32\msiexec.exe" Potential IP "5.1.0.0" found in string "Microsoft.Windows.Installer.Engine,processorArchitecture="*",type="win32",version="5.1.0.0"C:\WINDOWS\system32\msi.dll"46:T565,"3CXDesktopApp.exe" trying to open a file "C:\Users\Default\AppData\Roaming\3CXDesktopApp\LOCAL STORAGE\LEVELDB__TMP_FOR_REBUILD" "3CXDesktopApp.exe" trying to open a file "C:\Users\Default\AppData\Roaming\3CXDesktopApp\LOCAL STORAGE\LEVELDB" "3CXDesktopApp.exe" trying to open a file "C:\Users\Default\AppData\Roaming\3CXDesktopApp\Local Storage\leveldb\LOG" "3CXDesktopApp.exe" trying to open a file "C:\Users\Default\AppData\Roaming\3CXDesktopApp\Local Storage\leveldb\CURRENT" "3CXDesktopApp.exe" trying to open a file "C:\Users\Default\AppData\Roaming\3CXDesktopApp\Local Storage\leveldb\000001.dbtmp" "3CXDesktopApp.exe" trying to open a file "C:\Users\Default\AppData\Roaming\3CXDesktopApp\Local Storage\leveldb\MANIFEST-000001" "3CXDesktopApp.exe" trying to open a file "C:\Users\Default\AppData\Roaming\3CXDesktopApp\Local Storage\LEVELDB__TMP_FOR_REBUILD" "3CXDesktopApp.exe" trying to open a file "%APPDATA%\3CXDesktopApp\LOCAL STORAGE\LEVELDB__TMP_FOR_REBUILD" "3CXDesktopApp.exe" trying to open a file "%APPDATA%\3CXDesktopApp\LOCAL STORAGE\LEVELDB" "3CXDesktopApp.exe" trying to open a file "%APPDATA%\3CXDesktopApp\Local Storage\leveldb\000001.dbtmp" "3CXDesktopApp.exe" trying to open a file "%APPDATA%\3CXDesktopApp\Local Storage\leveldb\CURRENT" "3CXDesktopApp.exe" trying to open a file "%APPDATA%\3CXDesktopApp\Local Storage\LEVELDB__TMP_FOR_REBUILD"47:T631,"msiexec.exe" marked "C:\Windows\Installer\MSIED08.tmp" for deletion "msiexec.exe" marked "C:\Windows\Installer\MSIFCE8.tmp" for deletion "msiexec.exe" marked "C:\Windows\Installer\MSI258.tmp" for deletion "msiexec.exe" marked "C:\Windows\Installer\MSI68F.tmp" for deletion "msiexec.exe" marked "C:\Windows\Installer\MSI99D.tmp" for deletion "msiexec.exe" marked "C:\Config.Msi\MSIBD1.tmp" for deletion "msiexec.exe" marked "C:\Windows\Installer\MSI319A.tmp" for deletion "msiexec.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\3CX Ltd\3CX Desktop App.lnk~RF1341ee.TMP" for deletion "msiexec.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\3CX Ltd\3CX Desktop App.lnk~RF1347ca.TMP" for deletion "msiexec.exe" marked "C:\Windows\Installer\MSI4E4A.tmp" for deletion "msiexec.exe" marked "C:\Windows\Installer\12d868.msi" for deletion "msiexec.exe" marked "C:\Windows\Installer\MSIFBAF.tmp" for deletion "msiexec.exe" marked "C:\Config.Msi\MSI5C17.tmp" for deletion "msiexec.exe" marked "C:\Config.Msi\12d867.rbs" for deletion "msiexec.exe" marked "C:\Windows\Installer\MSI5C46.tmp" for deletion "msiexec.exe" marked "C:\Windows\Installer\12d866.msi" for deletion "msiexec.exe" marked "C:\Windows\Installer\inprogressinstallinfo.ipi" for deletion "3CXDesktopApp.exe" marked "C:\Users\Default\AppData\Roaming\3CXDesktopApp\Preferences~RF14875f.TMP" for deletion "3CXDesktopApp.exe" marked "C:\Users\Default\AppData\Roaming\3CXDesktopApp\Network\Network Persistent State~RF1557fd.TMP" for deletion48:Tc5c,"reg.exe" wrote bytes "a09d0657fe7f0000608e0657fe7f000090b70457fe7f0000a0900657fe7f0000508d0457fe7f0000502e0457fe7f000020c40657fe7f000070bb0657fe7f000080bc0657fe7f000040780757fe7f0000a0ba0657fe7f000000880657fe7f0000" to virtual address "0x58E14030" (part of module "GDI32.DLL") "3CXDesktopApp.exe" wrote bytes "70219058fe7f0000b0fd9058fe7f0000" to virtual address "0x53280208" (part of module "PROPSYS.DLL") "3CXDesktopApp.exe" wrote bytes "40359058fe7f000070219058fe7f0000b0fd9058fe7f0000" to virtual address "0x11235100" "3CXDesktopApp.exe" wrote bytes "e0c02a59fe7f000030ed2659fe7f0000f0f52859fe7f0000e0432259fe7f000060242359fe7f0000e03c2259fe7f000040f72859fe7f0000f04c2b59fe7f000070ba2459fe7f000040d82a59fe7f0000705d2b59fe7f0000" to virtual address "0x42EB40A8" (part of module "STRUCTUREDQUERY.DLL") "3CXDesktopApp.exe" wrote bytes "b013ab58fe7f00008014ab58fe7f0000" to virtual address "0x594D81C8" (part of module "COMBASE.DLL") "3CXDesktopApp.exe" wrote bytes "b0960d59fe7f0000c0a70859fe7f0000" to virtual address "0x5540E228" (part of module "NTMARTA.DLL") "3CXDesktopApp.exe" wrote bytes "801a3e55fe7f0000c05a3e55fe7f000020153e55fe7f000090263e55fe7f000050223e55fe7f0000f0163f55fe7f0000" to virtual address "0x58F1D3D8" (part of module "3CXDESKTOPAPP.EXE") "3CXDesktopApp.exe" wrote bytes "a0720859fe7f0000" to virtual address "0x42EB41A0" (part of module "STRUCTUREDQUERY.DLL") "3CXDesktopApp.exe" wrote bytes "30343556fe7f0000" to virtual address "0x426CF000" (part of module "MFPLAT.DLL") "3CXDesktopApp.exe" wrote bytes "d01e9058fe7f0000" to virtual address "0x532801F8" (part of module "PROPSYS.DLL") "3CXDesktopApp.exe" wrote bytes "202e2c56fe7f0000302e2c56fe7f0000" to virtual address "0x594D8378" (part of module "COMBASE.DLL") "3CXDesktopApp.exe" wrote bytes "20fef958fe7f000000faf958fe7f0000" to virtual address "0x594D80D8" (part of module "COMBASE.DLL") "3CXDesktopApp.exe" wrote bytes "10f31953fe7f000040ae1c53fe7f000040b81953fe7f000020af1c53fe7f0000503f1a53fe7f0000" to virtual address "0x49D57000" (part of module "WINDOWS.DEVICES.ENUMERATION.DLL") "3CXDesktopApp.exe" wrote bytes "20fef958fe7f000000faf958fe7f0000" to virtual address "0x58DB7180" (part of module "RPCRT4.DLL") "3CXDesktopApp.exe" wrote bytes "70312a56fe7f0000" to virtual address "0x42EB41B0" (part of module "STRUCTUREDQUERY.DLL") "3CXDesktopApp.exe" wrote bytes "60ebf958fe7f0000e0bff958fe7f0000e0bcf958fe7f0000" to virtual address "0x562B8050" (part of module "PROFAPI.DLL") "3CXDesktopApp.exe" wrote bytes "6069ce4ffe7f0000603ace4ffe7f0000c03cce4ffe7f0000" to virtual address "0x426CF010" (part of module "MFPLAT.DLL") "3CXDesktopApp.exe" wrote bytes "a01c0959fe7f0000601c0959fe7f0000d01b0959fe7f0000" to virtual address "0x594D8430" (part of module "COMBASE.DLL") "3CXDesktopApp.exe" wrote bytes "a0180959fe7f000090790759fe7f0000d02d0859fe7f0000302f0859fe7f0000b0870859fe7f000010800759fe7f000020770859fe7f000000440859fe7f0000a0830859fe7f000000ee0759fe7f0000c0780859fe7f0000" to virtual address "0x551A6378" (part of module "DXGI.DLL") "3CXDesktopApp.exe" wrote bytes "40359058fe7f000070219058fe7f0000b0fd9058fe7f0000" to virtual address "0x22435100"49:T999,"3CXDesktopApp.exe" wrote 4024 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 2452) "3CXDesktopApp.exe" wrote 8 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 2452) "3CXDesktopApp.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2620) "3CXDesktopApp.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2620) "3CXDesktopApp.exe" wrote 188 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2620) "3CXDesktopApp.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2620) "3CXDesktopApp.exe" wrote 16 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2620) "3CXDesktopApp.exe" wrote 216 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2620) "3CXDesktopApp.exe" wrote 296 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2620) "3CXDesktopApp.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2620) "3CXDesktopApp.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2756) "3CXDesktopApp.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 2756) "3CXDesktopApp.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 3280) "3CXDesktopApp.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 3280) "3CXDesktopApp.exe" wrote 332 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 3280) "3CXDesktopApp.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 3280) "3CXDesktopApp.exe" wrote 16 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe" (Handle: 3280)4a:T1173,Spawned process "3CXDesktopApp.exe" (UID: 00000000-00004940) Spawned process "3CXDesktopApp.exe" (UID: 00000000-00004976) Spawned process "reg.exe" with commandline "QUERY HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v 3CXDeskTopApp" (UID: 00000000-00002708) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2" (UID: 00000000-00006328) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=1732 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8" (UID: 00000000-00002244) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --app-user-model-id=9071E5B59CCA4D120EC8D975AF3F02AB --app-path="%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\resources\\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=1339093304 --mojo-platform-channel-handle=2504 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1" (UID: 00000000-00003800) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --app-user-model-id=9071E5B59CCA4D120EC8D975AF3F02AB --app-path="%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\resources\\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=1360230804 --mojo-platform-channel-handle=3576 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1" (UID: 00000000-00004960) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=3896 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8" (UID: 00000000-00006380) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=2024 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8" (UID: 00000000-00006872) Spawned process "3CXDesktopApp.exe" with commandline ""%APPDATA%\\3CXDesktopApp" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1204 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2" (UID: 00000000-00002596)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790794920482,"unified_at":"2026-09-30T19:02:00.482Z","metadata":{"hashes":{"sha256":"aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868","sha1":"bea77d1e59cf18dce22ad9a2fad52948fd7a9efa","md5":"f3d4144860ca10ba60f7ef4d176cc736","sha512":"19f43d1d74d39a08d3c44c21eca096590d090e71ef37fdc91ac5e35c4679b2762c5bf6d2a9dae4de4d4843759cea7dd1cdc369965a76ddc75c41121ab03ddb17","ssdeep":"1572864:VrY4XCS040dRj9GGkEoRNKZMT2IPf28c0nWnm6Kby5t12EOSJD2xAylyXwkLHRRu:NY4XCh7SNWgXX2ryCbKbCt12DVlg3La","ssdeep_chunks":["1572864:VrY4XCS","1572864:rY4XCS0","1572864:Y4XCS04","1572864:4XCS040","1572864:XCS040d","1572864:CS040dR","1572864:S040dRj","1572864:040dRj9","1572864:40dRj9G","1572864:0dRj9GG","1572864:dRj9GGk","1572864:Rj9GGkE","1572864:j9GGkEo","1572864:9GGkEoR","1572864:GGkEoRN","1572864:GkEoRNK","1572864:kEoRNKZ","1572864:EoRNKZM","1572864:oRNKZMT","1572864:RNKZMT2","1572864:NKZMT2I","1572864:KZMT2IP","1572864:ZMT2IPf","1572864:MT2IPf2","1572864:T2IPf28","1572864:2IPf28c","1572864:IPf28c0","1572864:Pf28c0n","1572864:f28c0nW","1572864:28c0nWn","1572864:8c0nWnm","1572864:c0nWnm6","1572864:0nWnm6K","1572864:nWnm6Kb","1572864:Wnm6Kby","1572864:nm6Kby5","1572864:m6Kby5t","1572864:6Kby5t1","1572864:Kby5t12","1572864:by5t12E","1572864:y5t12EO","1572864:5t12EOS","1572864:t12EOSJ","1572864:12EOSJD","1572864:2EOSJD2","1572864:EOSJD2x","1572864:OSJD2xA","1572864:SJD2xAy","1572864:JD2xAyl","1572864:D2xAyly","1572864:2xAylyX","1572864:xAylyXw","1572864:AylyXwk","1572864:ylyXwkL","1572864:lyXwkLH","1572864:yXwkLHR","1572864:XwkLHRR","1572864:wkLHRRu","3145728:VrY4XCS","3145728:rY4XCS0","3145728:Y4XCS04","3145728:4XCS040","3145728:XCS040d","3145728:CS040dR","3145728:S040dRj","3145728:040dRj9","3145728:40dRj9G","3145728:0dRj9GG","3145728:dRj9GGk","3145728:Rj9GGkE","3145728:j9GGkEo","3145728:9GGkEoR","3145728:GGkEoRN","3145728:GkEoRNK","3145728:kEoRNKZ","3145728:EoRNKZM","3145728:oRNKZMT","3145728:RNKZMT2","3145728:NKZMT2I","3145728:KZMT2IP","3145728:ZMT2IPf","3145728:MT2IPf2","3145728:T2IPf28","3145728:2IPf28c","3145728:IPf28c0","3145728:Pf28c0n","3145728:f28c0nW","3145728:28c0nWn","3145728:8c0nWnm","3145728:c0nWnm6","3145728:0nWnm6K","3145728:nWnm6Kb","3145728:Wnm6Kby","3145728:nm6Kby5","3145728:m6Kby5t","3145728:6Kby5t1","3145728:Kby5t12","3145728:by5t12E","3145728:y5t12EO","3145728:5t12EOS","3145728:t12EOSJ","3145728:12EOSJD","3145728:2EOSJD2","3145728:EOSJD2x","3145728:OSJD2xA","3145728:SJD2xAy","3145728:JD2xAyl","3145728:D2xAyly","3145728:2xAylyX","3145728:xAylyXw","3145728:AylyXwk","3145728:ylyXwkL","3145728:lyXwkLH","3145728:yXwkLHR","3145728:XwkLHRR","3145728:wkLHRRu","1572864:NY4XCh7","1572864:Y4XCh7S","1572864:4XCh7SN","1572864:XCh7SNW","1572864:Ch7SNWg","1572864:h7SNWgX","1572864:7SNWgXX","1572864:SNWgXX2","1572864:NWgXX2r","1572864:WgXX2ry","1572864:gXX2ryC","1572864:XX2ryCb","1572864:X2ryCbK","1572864:2ryCbKb","1572864:ryCbKbC","1572864:yCbKbCt","1572864:CbKbCt1","1572864:bKbCt12","1572864:KbCt12D","1572864:bCt12DV","1572864:Ct12DVl","1572864:t12DVlg","1572864:12DVlg3","1572864:2DVlg3L","1572864:DVlg3La"],"imphash":"Unknown"},"file_info":{"file_name":"aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868","file_type":["msi","data"],"file_type_id":"msi","file_size":102522880,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1680122459000,"last_seen":1709086377000,"last_multi_scan":1709086377000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","blackmoon","floxif","labyrinthchollima","targeted"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":79,"suspicious_count":25,"malicious_count":5,"total":109},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/MSI.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.apmp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win64/NukeSped.OY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic Trojan.th","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Mdrop-JTQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/NukeSped.OY trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Found Windows API related strings"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Calls an API typically used to performs encryption on the data"},{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Loads the cryptographic module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Possibly use system binaries"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Uses REG.EXE to query registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads the hosts file"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Tries to access browsers sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Process binds to unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"3CXDesktopApp.exe\" called \"FindResourceW\" with parameter \"145\" - (UID: 00000000-00004976)\n \"3CXDesktopApp.exe\" called \"FindResourceW\" (UID: 00000000-00004976)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"msiexec.exe\" called \"LoadResource\" (UID: 00000000-00006048)\n \"msiexec.exe\" called \"LoadResource\" (UID: 00000000-00006456)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\MSI2d52a.tmp (UID: 00000000-00006048)\n \"msiexec.exe\" called \"RemoveDirectoryW\" with parameter Z:\\MSI2d52b.tmp (UID: 00000000-00006048)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Observed string:\"IsDebuggerPresent\" [Source: 3CXDesktopApp.exe.1413653332]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 38600-1670-00405861\n SetUnhandledExceptionFilter@KERNEL32.dll at 38600-1095-00405379","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"MsiExec.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004236)\n \"3CXDesktopApp.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004976)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"msiexec.exe\" called \"IsWow64Process\" with parameter \"6456\" - (UID: 00000000-00006456)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"3CXDesktopApp.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004976)\n \"3CXDesktopApp.exe\" called \"EnumWindows\" with parameter \"1082126208\" - (UID: 00000000-00004976)","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"msiexec.exe\" called \"GetWindowTextW\" (UID: 00000000-00006048)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00006048)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Preparing to install...\" - (UID: 00000000-00006048)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Please wait while Windows configures 3CX Desktop App\" - (UID: 00000000-00006048)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"3CXDesktopApp.exe\" called \"GetActiveWindow\" (UID: 00000000-00004976)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006048)\n \"msiexec.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006048)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"msiexec.exe\" called \"OpenMutexW\" with parameter \"Global\\_MSIExecute\" - (UID: 00000000-00006456)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00006048)\n \"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00006456)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006048)\n \"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006456)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 38600-1147-0040A6FB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$26","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Observed api: \"GetUserDefaultUILanguage\"[Source: 00000000-00006048.00000000.78917.3432A000.00000002.mdmp\n 00000000-00006048.00000001.80839.3432A000.00000002.mdmp]\n Observed api: \"GetUserDefaultUILanguage\"[Source: 00000000-00006456.00000000.79169.3432A000.00000002.mdmp\n 00000000-00006456.00000001.81089.3432A000.00000002.mdmp\n 00000000-00006456.00000002.83010.3432A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: 3CXDesktopApp.exe.1413653332]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 38600-1749-0040B741","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\0\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"3CXDesktopApp.exe\" queries volume information of \"C:\\\" at 00000000-00004976-00000C15-131778869","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"3CXDesktopApp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"3CXDesktopApp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$29","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/58 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\3CXDesktopApp.exe\"\" - (UID: 00000000-00004236)\n \"3CXDesktopApp.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\reg.exe QUERY HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v 3CXDeskTopApp\" - (UID: 00000000-00004976)\n \"3CXDesktopApp.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe\" --type=gpu-process --disable-gpu-sandbox --use-gl=di\" - (UID: 00000000-00004976)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$2d","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Observed API string: \"CreateThread\" [Source: 00000000-00006048-00000C1E-73042663]\n Observed API string: \"CreateThread\" [Source: 00000000-00006048-00000C1E-73043108]\n Observed API string: \"CreateThread\" [Source: 00000000-00006048-00000C1E-73046256]\n Observed API string: \"OpenThread\" [Source: 00000000-00006048.00000000.78917.3432A000.00000002.mdmp\n 00000000-00006048.00000001.80839.3432A000.00000002.mdmp]\n Observed API string: \"CreateThread\" [Source: 00000000-00006048.00000000.78917.3432A000.00000002.mdmp\n 00000000-00006048.00000001.80839.3432A000.00000002.mdmp]\n Observed API string: \"OpenThread\" [Source: 00000000-00006456.00000000.79169.3432A000.00000002.mdmp\n 00000000-00006456.00000001.81089.3432A000.00000002.mdmp\n 00000000-00006456.00000002.83010.3432A000.00000002.mdmp]\n Observed API string: \"CreateThread\" [Source: 00000000-00006456.00000000.79169.3432A000.00000002.mdmp\n 00000000-00006456.00000001.81089.3432A000.00000002.mdmp\n 00000000-00006456.00000002.83010.3432A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4976:120:WilError_01\"\n \"3CXDesktopAppProcessSingletonStartup\"\n \"Local\\SM0:4976:120:WilError_01\"\n \"SM0:4976:120:WilError_01\"\n \"Local\\SM0:4976:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\3CXDesktopAppProcessSingletonStartup\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4976:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:4976:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:2244:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2244:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$31","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 43970000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 58CA0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 754E0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 58CA0000\n \"3CXDesktopApp.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 754E0000\n \"3CXDesktopApp.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 58CA0000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 58CA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 573A0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76D70000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 573A0000\n \"3CXDesktopApp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76D70000\n \"3CXDesktopApp.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 573A0000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 573A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c76756fe7f0000@ntdll.dll\"\n \"220023000000000018c76756fe7f0000@ntdll.dll\"\n \"19001a006e00000040c76756fe7f0000@ntdll.dll\"\n \"\"#n@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$34","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\msiexec.exe\" [Source: 00000000-00006456-00000BC1-88308607]","origin":"File/Memory","mitre_attack_id":"T1036","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$35","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"3CXDesktopApp.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"\n \"3CXDesktopApp.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$37","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$39","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"3CXDesktopApp.VisualElementsManifest.xml\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"3CXDesktopApp.exe\" writes a file \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\logs\\main.log\"\n \"3CXDesktopApp.exe\" writes a file \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\Local Storage\\leveldb\\000001.dbtmp\"\n \"3CXDesktopApp.exe\" writes a file \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\Session Storage\\000001.dbtmp\"\n \"3CXDesktopApp.exe\" writes a file \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\Session Storage\\000003.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ5suEceKjAJbxseAmHFkQ9FrhTWQQUDuE6qFM6MdWKvsG7rWcaA4WtNA4CEBtmEd%2Bcmk1uzI7VDJuReHM%3D\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3d","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"{\"net\":{\"http_server_properties\":{\"servers\":[{\"alternative_service\":[{\"advertised_alpns\":[\"h3\"],\"expiration\":\"13327189408682676\",\"port\":443,\"protocol_str\":\"quic\"}],\"isolation\":[],\"server\":\"https://dns.google\",\"supports_spdy\":true}],\"version\":5},\"network_qualities\":{\"CAESABiAgICA+P////8B\":\"4G\"}}}\" (Indicator: \"https://\")\n \"https://sectigo.com/CPS0\" (Indicator: \"https://\")\n \"%https://certs.godaddy.com/repository/0\" (Indicator: \"https://\")\n \"https://www.thawte.com/cps07\" (Indicator: \"https://\")\n \"&https://www.globalsign.com/repository/03\" (Indicator: \"https://\")\n \"https://www.digicert.com/CPS0\" (Indicator: \"https://\")\n \"https://www.verisign.com/CPS04\" (Indicator: \"https://\")\n \"$https://www.alphassl.com/repository/03\" (Indicator: \"https://\")\n \"2Terms of use at https://www.verisign.com/rpa (c)101.0,\" (Indicator: \"https://\")\n \"https://d.symcb.com/cps0%\" (Indicator: \"https://\")\n \"https://d.symcb.com/rpa0\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"Update.exe\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"$3e","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"msiexec.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00006048)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"msiexec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006048)\n \"msiexec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006456)\n \"MsiExec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002944)\n \"3CXDesktopApp.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00004940)\n \"reg.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002708)\n \"3CXDesktopApp.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002244)\n \"3CXDesktopApp.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006872)\n \"3CXDesktopApp.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002596)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"3CXDesktopApp.exe\" called \"GetComputerNameW\" (UID: 00000000-00004976)\n \"3CXDesktopApp.exe\" called \"GetComputerNameW\" (UID: 00000000-00002244)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string:\"GetModuleFileName\" [Source: 3CXDesktopApp.exe.1413653332]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00006048.00000000.78917.3432A000.00000002.mdmp\n 00000000-00006048.00000001.80839.3432A000.00000002.mdmp]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00006456.00000000.79169.3432A000.00000002.mdmp\n 00000000-00006456.00000001.81089.3432A000.00000002.mdmp\n 00000000-00006456.00000001.81089.42970000.00000004.mdmp\n 00000000-00006456.00000002.83010.3432A000.00000002.mdmp]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00006456.00000001.81089.42970000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$40","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"3CXDesktopApp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")\n \"3CXDesktopApp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PROFILEENUMMODE\")\n \"3CXDesktopApp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"ICMPROFILE\")\n \"3CXDesktopApp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"VULKANIMPLICITLAYERS\")\n \"3CXDesktopApp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"VULKANEXPLICITLAYERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Uses REG.EXE to query registry keys","description":"Process \"reg.exe\" with commandline \"QUERY HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run /v 3CXDeskTopApp\" (UID: 00000000-00002708)","origin":"Monitored Target","mitre_attack_id":"T1012","relevance":3,"id":"target-144","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Observed string:\"CreateProcessAsUserW\" [Source: 00000000-00004976-00000C1E-133489111]","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VSS\\DIAG\")\n \"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VSS\\DIAG\\SPP\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\MSIEXEC.EXE\"; Value: \"557FF2B68162D90100000000000000000000000002000000\")\n \"3CXDesktopApp.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$41","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$42","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$43","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; in Source: \"00000000-00006048.00000000.78917.B9550000.00000004.mdmp, 00000000-00006048.00000001.80839.B9550000.00000004.mdmp\")\n Found string \"ECDSA\" (Indicator: \"ecdsa\"; in Source: \"00000000-00006456.00000001.81089.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.34420000.00000004.mdmp, 00000000-00006456.00000002.83010.3447F000.00000004.mdmp, 00000000-00006456.00000002.83010.344AB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 38600-290-004054E9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 38600-1201-0040B75E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\FDDB1A37F2F29A54AAA81CBB930E2238\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"MsiExec.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"MsiExec.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$44","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"3CXDESKTOPAPP\"; Value: \"\"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\3CXDesktopApp.exe\" autoLaunch\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$45","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"Process \"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe\" binds to port 5566","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Network Related","name":"Reads the hosts file","description":"\"3CXDesktopApp.exe\" read 4096 bytes from file \"C:\\Windows\\System32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00006456.00000001.81089.3CA80000.00000004.mdmp\")\n Found string \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\"; in Source: \"00000000-00006456.00000001.81089.3CA80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"3CXDesktopApp.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to performs encryption on the data","description":"\"3CXDesktopApp.exe\" called \"CryptProtectData\" (UID: 00000000-00004976)","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-171","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"msiexec.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00006048)\n \"msiexec.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00006456)\n \"MsiExec.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00004236)\n \"3CXDesktopApp.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00004976)\n \"3CXDesktopApp.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002244)\n \"3CXDesktopApp.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002596)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 38600-1676-0040B10A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 38600-1145-00408C4B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"3CXDesktopApp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access browsers sensitive information (file access)","description":"$46","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$47","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"msiexec.exe\" opened \"C:\\Windows\\Installer\\MSIFCE8.tmp\" with delete access\n \"MsiExec.exe\" opened \"C:\\Windows\\SysWOW64\\MSIWERCRASHMETADATA-41\" with delete access\n \"MsiExec.exe\" opened \"C:\\MsiWerCrashmetadata-41\" with delete access\n \"3CXDesktopApp.exe\" opened \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\Code Cache\\js\\INDEX-DIR\\THE-REAL-INDEX\" with delete access\n \"3CXDesktopApp.exe\" opened \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\Code Cache\\wasm\\INDEX-DIR\\THE-REAL-INDEX\" with delete access\n \"3CXDesktopApp.exe\" opened \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\Code Cache\\js\\index-dir\\THE-REAL-INDEX\" with delete access\n \"3CXDesktopApp.exe\" opened \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\Code Cache\\js\\index-dir\\temp-index\" with delete access\n \"3CXDesktopApp.exe\" opened \"C:\\Users\\Default\\AppData\\Roaming\\3CXDesktopApp\\Code Cache\\wasm\\index-dir\\THE-REAL-INDEX\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"MsiExec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"MSI5C46.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI5C46.tmp]- [targetUID: 00000000-00006456]\n \"MSI258.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI258.tmp]- [targetUID: 00000000-00006456]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$48","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"3CXDesktopApp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\3CXDesktopApp.exe\"\" - (UID: 00000000-00004236)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"MsiExec.exe\" called \"ShellExecuteW\" with parameter %LOCALAPPDATA%\\Programs\\3CXDesktopApp\\3CXDesktopApp.exe (UID: 00000000-00004236)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"3CXDesktopApp.exe\" allocated memory in \"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$49","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":22,"imported_dlls_count":183,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":56,"files_deleted_count":0,"registry_keys_created_count":17,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":17,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["banker","blackmoon","floxif","labyrinthchollima","targeted"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"6424a24fac194043770139bd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868","analysis_start_time":"2023-03-29T20:55:57+00:00","indicators_count":{"informative":79,"suspicious":37,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"ocsp.sectigo.com","address":"104.18.32.68","ttl":3600,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}],"http_requests":[{"host":"ocsp.sectigo.com","host_ip":"104.18.32.68:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ5suEceKjAJbxseAmHFkQ9FrhTWQQUDuE6qFM6MdWKvsG7rWcaA4WtNA4CEBtmEd%2Bcmk1uzI7VDJuReHM%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ5suEceKjAJbxseAmHFkQ9FrhTWQQUDuE6qFM6MdWKvsG7rWcaA4WtNA4CEBtmEd%2Bcmk1uzI7VDJuReHM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}],"processes":[{"pid":6048,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00006048","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":6456,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00006456","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":4236,"ppid":6456,"name":"MsiExec.exe","command_line":"-Embedding E2E52B8FA57D16C914D60CC454931D1A","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00006456","uid":"00000000-00004236"},{"pid":4940,"ppid":4236,"name":"3CXDesktopApp.exe","command_line":"","sha256":"54004dfaa48ca5fa91e3304fb99559a2395301c570026450882d6aad89132a02","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\3CXDesktopApp.exe","parent_uid":"00000000-00004236","uid":"00000000-00004940"},{"pid":4976,"ppid":4940,"name":"3CXDesktopApp.exe","command_line":"","sha256":"dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe","parent_uid":"00000000-00004940","uid":"00000000-00004976"},{"pid":2708,"ppid":4976,"name":"reg.exe","command_line":"QUERY HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v 3CXDeskTopApp","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00004976","uid":"00000000-00002708"},{"pid":6328,"ppid":4976,"name":"3CXDesktopApp.exe","command_line":"\"%APPDATA%\\3CXDesktopApp\" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2","sha256":"dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe","parent_uid":"00000000-00004976","uid":"00000000-00006328"},{"pid":2244,"ppid":4976,"name":"3CXDesktopApp.exe","command_line":"\"%APPDATA%\\3CXDesktopApp\" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=1732 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8","sha256":"dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe","parent_uid":"00000000-00004976","uid":"00000000-00002244"},{"pid":3800,"ppid":4976,"name":"3CXDesktopApp.exe","command_line":"\"%APPDATA%\\3CXDesktopApp\" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --app-user-model-id=9071E5B59CCA4D120EC8D975AF3F02AB --app-path=\"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\resources\\app.asar\" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=1339093304 --mojo-platform-channel-handle=2504 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1","sha256":"dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe","parent_uid":"00000000-00004976","uid":"00000000-00003800"},{"pid":4960,"ppid":4976,"name":"3CXDesktopApp.exe","command_line":"\"%APPDATA%\\3CXDesktopApp\" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --app-user-model-id=9071E5B59CCA4D120EC8D975AF3F02AB --app-path=\"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\resources\\app.asar\" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=1360230804 --mojo-platform-channel-handle=3576 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1","sha256":"dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe","parent_uid":"00000000-00004976","uid":"00000000-00004960"},{"pid":6380,"ppid":4976,"name":"3CXDesktopApp.exe","command_line":"\"%APPDATA%\\3CXDesktopApp\" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=3896 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8","sha256":"dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe","parent_uid":"00000000-00004976","uid":"00000000-00006380"},{"pid":6872,"ppid":4976,"name":"3CXDesktopApp.exe","command_line":"\"%APPDATA%\\3CXDesktopApp\" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=2024 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8","sha256":"dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe","parent_uid":"00000000-00004976","uid":"00000000-00006872"},{"pid":2596,"ppid":4976,"name":"3CXDesktopApp.exe","command_line":"\"%APPDATA%\\3CXDesktopApp\" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1204 --field-trial-handle=1660,i,15779800834623648142,17910684628944807265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2","sha256":"dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc","normalized_path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\3CXDesktopApp.exe","parent_uid":"00000000-00004976","uid":"00000000-00002596"},{"pid":2944,"ppid":6456,"name":"MsiExec.exe","command_line":"-Embedding 08ED0AC967CF009FECA3900309E3A85C","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00006456","uid":"00000000-00002944"}],"all_imported_dlls":["winsta.dll","dxgi.dll","twinapi.appcore.dll","directmanipulation.dll","bcryptprimitives.dll","dnsapi.dll","dpapi.dll","dxva2.dll","msvproc.dll","ksuser.dll","deviceassociation.dll","wkscli.dll","netutils.dll","crypt32.dll","mfcore.dll","ws2_32.dll","dwmapi.dll","cryptbase.dll","pcacli.dll","cscapi.dll","MMDevAPI.dll","windows.storage.dll","kernel.appcore.dll","rasadhlp.dll","wow64win.dll","wow64cpu.dll","oleacc.dll","D3D12.dll","kernel32.dll","cryptsp.dll","dhcpcsvc6.dll","cabinet.dll","DataExchange.dll","msi.dll","ntmarta.dll","cldapi.dll","mfperfhelper.dll","DevDispItemProvider.dll","VxSSL64.dll","coml2.dll","clbcatq.dll","webio.dll","atlthunk.dll","Windows.Devices.Enumeration.dll","rpcss.dll","msisip.dll","OnDemandConnRouteHelper.dll","dcomp.dll","devenum.dll","gdi32.dll","bcrypt.dll","nsi.dll","urlmon.dll","UIAutomationCore.dll","rmclient.dll","actxprxy.dll","libEGL.dll","rpcrt4.dll","gpapi.dll","mpr.dll","ntshrui.dll","srvcli.dll","msIso.dll","nlaapi.dll","wtsapi32.dll","TextInputFramework.dll","wintrust.dll","srclient.dll","wow64.dll","imagehlp.dll","mfplat.dll","CompPkgSup.dll","avrt.dll","sechost.dll","comctl32.dll","powrprof.dll","netapi32.dll","sxs.dll","ExplorerFrame.dll","RTWorkQ.dll","Windows.Media.dll","ntdll.dll","dbghelp.dll","Windows.UI.dll","msmpeg2vdec.dll","MFCaptureEngine.dll","KernelBase.dll","msasn1.dll","winhttp.dll","vcruntime140_clr0400.dll","iertutil.dll","ffmpeg.dll","msimg32.dll","OneCoreUAPCommonProxyStub.dll","gdi32full.dll","advapi32.dll","CoreMessaging.dll","clr.dll","RstrtMgr.dll","linkinfo.dll","oleaccrc.dll","libGLESv2.dll","user32.dll","IPHLPAPI.DLL","wldp.dll","profapi.dll","twinapi.dll","mfreadwrite.dll","d3d10warp.dll","edputil.dll","cfgmgr32.dll","propsys.dll","winnsi.dll","aepic.dll","fwbase.dll","MsSpellCheckingFacility.dll","imm32.dll","ole32.dll","SHCore.dll","fltLib.dll","cryptnet.dll","ResourcePolicyClient.dll","combase.dll","shell32.dll","dhcpcsvc.dll","Windows.StateRepositoryPS.dll","CoreUIComponents.dll","fusion.dll","BCP47Langs.dll","d3d11.dll","MSWB7.dll","sspicli.dll","FirewallAPI.dll","d3dcompiler_47.dll","ncrypt.dll","ntasn1.dll","secur32.dll","StructuredQuery.dll","WinTypes.dll","FWPUCLNT.DLL","winmm.dll","wininet.dll","srpapi.dll","mswsock.dll","userenv.dll","setupapi.dll","winmmbase.dll","mf.dll","shlwapi.dll","sfc_os.dll","version.dll","mscoree.dll","Windows.Globalization.dll","msvcp110_win.dll","uxtheme.dll","mscoreei.dll","vssapi.dll","vsstrace.dll","ucrtbase_clr0400.dll","devobj.dll","msdmo.dll","dxilconv.dll","ucrtbase.dll","oleaut32.dll","spp.dll","DWrite.dll","KBDUS.DLL","vk_swiftshader.dll","AudioSes.dll","mfsensorgroup.dll","msctf.dll","winnlsres.dll","mscms.dll","biwinrt.dll","fwpolicyiomgr.dll","msvcrt.dll","rsaenh.dll","msihnd.dll","vulkan-1.dll","apphelp.dll","AcLayers.dll","win32u.dll","msvcp_win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Update.exe","sha256":"72349cf4971607c1bc66314069f0c864e8aa4336a663f2afbc2cb7e852465430","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"snapshot_blob.bin","sha256":"f9c472794aa190e96eac204d6c2d86c9ef63bfd6fef8df69f39b85cf4ad853c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"3CXDesktopApp.exe","sha256":"54004dfaa48ca5fa91e3304fb99559a2395301c570026450882d6aad89132a02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"d3dcompiler_47.dll","sha256":"11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"ffmpeg.dll","sha256":"7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"libEGL.dll","sha256":"44febbc02e69d492d39e2cd5d025bbf0d81b1889b37725bd700cc0c21e5ba22a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"v8_context_snapshot.bin","sha256":"47a8d799b55ba4c7a55498e0876521ad11cc2fa349665b11c715334a77f72b29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"vk_swiftshader.dll","sha256":"18436e3ffaa5ad29f0fa0daba05cfd99ad6ae2ccc7d6a5bff9d4decd97c0993e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"vulkan-1.dll","sha256":"1c7fe50af9f2c7722274ee55c28bc1e786effbed15943909d8da8f3492275574","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"1ff73208-3568-43aa-87d0-8f15bf8df62a.tmp","sha256":"be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"48445e32-bc31-45b6-b0e5-b7613ee8556e.tmp","sha256":"cb06a76bbd26e926a96ee6a4957cb86eeaed59197382476ab9ebd15fd7e5273d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"data_0","sha256":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"data_1","sha256":"ee668786da95a4ca391728c89df78cd476ddaadb6cb6485c32f92039f4b91c72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"data_2","sha256":"ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"data_3","sha256":"e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"index","sha256":"a236b1a84bf323421880f54819eba6b6d984a0450b14769f48b3626c98bc61af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"temp-index","sha256":"6ffd1dabfec01a8933d3a83053da1075f44fd54a67908fb564d318876419dfec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"000001.dbtmp","sha256":"0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"000003.log","sha256":"a827f008c0595a4d390c546a9a2f073e7ebcf2c6c53b02750e0523071614ed3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"LOG","sha256":"d8997d970f57bef0635178c6493e6c76d2c1d287cc764b14340e8a6d747fd899","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"MANIFEST-000001","sha256":"f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"60a7a59e-0e00-4eaf-8e0c-c54135336c99.tmp","sha256":"9cb90e5e6ac921de25dbc141a6d7d7a434242ea5841acb428c484d4e7acf7260","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"8f53be0a-bc0a-4362-a526-af8ab2f5807e.tmp","sha256":"1611be9377d30c37a640a6b8d00e4664e31532f726d125a83d814cf19d02f3f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Cookies","sha256":"3c6e069a7df07ee5eca265821545bd9b5a0be65dca21805d42b10133d12916cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Cookies-journal","sha256":"2eb2236585405f1048debf490b8ca3781c0dffb1e8ab3a7299adb0e13d26377b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"db615ac9-2a21-4823-9a7d-fa80d0778664.tmp","sha256":"226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"a2072310-fd28-4d29-9390-3cfe5bf8e330.tmp","sha256":"a1d969bc512f1ad4f63a4aaa2caa97aa8efd0221c413d59827e63da15d494f11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"main.log","sha256":"c69e7b8908724f2ef048ec00b8f50cf3ebe8aeca80b0aea7ae000b1a3f083f31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"3CX Desktop App.lnk","sha256":"b11db5c173895444e51472258e818069ffa21cffcd15f9459611b0525cab99ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}],"files_written":[{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DF75561AF2F5B66F5F.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Installer\\SourceHash{73A1BDDF-2F2F-45A9-AA8A-C1BB39E02283}","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DF349A94197F7AF9A5.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DFD49AE082A92C8014.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DFF8325517931857C3.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app-18.12.407\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app-18.12.407\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app-18.12.407\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app-18.12.407\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app-18.12.407\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app-18.12.407\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app-18.12.407\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app-18.12.407\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\3CX Ltd\\~CX Desktop App.tmp","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Installer\\12d868.msi","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DFD3A8E0E52355D5F3.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DFCCDA87D4B1B77AE8.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DFF13E552F3AE16328.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DF8A061873625D0B13.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DF35BF4D403B379681.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DFE2E7A92659FA2EB8.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DFCCE09C9158A14C57.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%WINDIR%\\Temp\\~DF3465199F7B8D330D.TMP","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Programs\\3CXDesktopApp\\app\\manifest","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\lockfile","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\logs","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Code Cache","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Local Storage\\leveldb\\LOG","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Local Storage\\leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Local Storage\\leveldb\\000003.log","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\.first-time","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%TEMP%\\96e72ec1-44ea-4ddf-8cbe-f038de040d32.tmp","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Session Storage\\LOG","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Session Storage\\LOCK","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Session Storage\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Session Storage\\000003.log","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%TEMP%\\a3c1830b-c167-47e2-8f0f-a2accd18a31b.tmp","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%APPDATA%\\3CXDesktopApp\\logs\\main.log","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\0","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\1033","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VSS\\DIAG\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VSS\\DIAG\\SPP\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4976:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"3CXDesktopAppProcessSingletonStartup","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Local\\SM0:4976:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"SM0:4976:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Local\\SM0:4976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3CXDesktopAppProcessSingletonStartup","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4976:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Local\\SM0:2244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"SM0:2244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Local\\SM0:6872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"SM0:6872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"Local\\SM0:2596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]},{"name":"SM0:2596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6424a24fac194043770139bd"}]}]}},"report_ids":{"sandbox_job_ids":["6424a24fac194043770139bd"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win64/NukeSped.OY trojan Sample aa124a4b4df1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample aa124a4b4df1…. Malware family: Win64/NukeSped.OY trojan. Threat score 100/100. 6/24 AV engines flagged this file. 5 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/NukeSped.OY trojan Sample aa124a4b4df1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample aa124a4b4df1…. Malware family: Win64/NukeSped.OY trojan. Threat score 100/100. 6/24 AV engines flagged this file. 5 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/NukeSped.OY trojan Sample aa124a4b4df1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample aa124a4b4df1…. Malware family: Win64/NukeSped.OY trojan. Threat score 100/100. 6/24 AV engines flagged this file. 5 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4b","11",{}]]