24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 66:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.4F26F41B.A.Generic Sample 015de283d33b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 015de283d33b…. Malware family: Dacic.4F26F41B.A.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 16 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d","keywords":["Malicious","Dacic.4F26F41B.A.Generic","malware analysis","sandbox report","threat intelligence","015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d"],"about":{"@type":"SoftwareApplication","name":"chungzx.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.4F26F41B.A.Generic","antivirusDetections":{"malicious":19,"total":26},"behavioralIndicators":{"malicious":16,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Td73,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")26:Tc9b,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")27:T6e6,Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")28:Tdb2,Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp")29:T43e,Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00001008-00000C2A-763615555") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001008-00000C2A-763615609") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp")2a:T2afe,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000dbf23516338ee97008026f00687d4f74b0f16f00d0bbe9705792b166feffffffccf06f005273e87070f06f000000ab7568f16f006b73e870e0df3f7408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000f8f06f00000000000800000000000000000000000000000000000000000000000000ab75f3f235160000000038f16f0069920374ffffffff34000000f8f06f0008000000000000000000ab7568f16f002794037400f16f000b0000000000000050f16f00 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000058d36f00fcd26f00226eeb730000b002000000002d6eeb732179811d2d000000ecb7677480d36f0000003700b0b07d02d8327c020d00000080000000c0d26f000000370044d36f0070c8ec7325da1f6efeffffff2d000000d0cc76742700000014d36f00856aed731c23f27354d36f00f85fed7308000000bb69ec73b269ec738978811d2d000000ecb7677427000000d0cc767428d36f002d000000d0cc76742700000058d36f00856aed731c23f273a0d36f007e8a7574ee8c7574738a75746e96f14e2d000000ecb7677427000000d0cc7674ac28b0024028b0026e96f14e68d36f00fc52b37454d46f00e0847574f6b42f3afeffffff738a7574 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000aa6e187daa6e00000000d0a97876000071769011727650947c0260ca7602c8cc7d0218e96f00feffffffc0eb6f00506aff7631d7dc2efeffffffd8e96f00eaa9fb7650947c0200000000c8cc7d02a11400000a000b00b297aa6e5c76aa6e6876aa6ec8cc7d02000e7e0214000000000000000000000050947c0200ea6f00cc2d0077c8cc7d0200000000d4cc7d0200000000f800a36e00000000cc0d24385ce8fe766840fd760c030000190000001100000010000000e0bd750238ea6f008d9a8273f0ba7502b4f17d020000000058ea6f002c057502b4f17d0270ea6f000000a36efeffffff0400000020af827300000000000000000000a36e60ea6f00 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000001c0000000000b002a8df6f000000000000000000a301fc76d1c2b459104d3e07d007bd042800000000000000080000000000bd0400000000b0240002000000000a020008f02f3e078080b0020100000000000000200000000000bd04cc01bd040408bd04000000000008bd0400000000a0df6f005916fc761c000000000000000407746e0000b0020000000028000000000000000000000005000000020000000000b0021c000000000000000c5bb002c0df6f00ee13fc761c000000ee13fc7600000000000000001c000000ffffffffe0df6f005072eb730000b002000000001c0000000407746e (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000fb76201840072018400700000000a05d4007e0c03f07580c400735000000f0c03f071100240050f5fb7608443f0708443f07000000001974811d20bd3e07383a3f071c00000030bd3e070a000e0050f5fb769833400798334007000000002018400730c13f07682c40073800000040c13f0701003800700abd0464000000d14b811d08443f0708443f0700000000feffffff8470eb7338e06f006570eb730000b002000000008470eb73e54b811d983340079833400700000000e32e706e08443f07b5ce6c6eafaa53a100e06f00176f6d6e94e06f0070c8ec73fdd91f6efeffffff8470eb730a8e6f6e98334007f08d6f6e60e06f00a7ce6c6e01000000 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000fb7620184007201840070000000000000000e0c03f07580c40073500000050f5fb76183b3f07183b3f07000000008470eb7320bd3e07383a3f070200000030bd3e070a000e00e00cbd046400000050f5fb769833400798334007000000002018400730c13f07682c40073800000040c13f0701003800700abd0464000000183b3f07183b3f0700000000feffffff8470eb7334e06f006570eb730000b002000000008470eb73e94b811d983340079833400700000000e32e706e183b3f07b5ce6c6e93aa53a1fcdf6f00176f6d6e94e06f0070c8ec73fdd91f6efeffffff8470eb730a8e6f6e98334007f08d6f6e5ce06f00a7ce6c6e01000000504b6d6e (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000007c025005a472000000002a006b73fc8664732a006b73fb8cfc760000000000000000fc86647330e16f000000000000000000000000002a006b7309000000b08a7c0209000000fc866473000000005005a4721800000013e23516338ee97040f26e0000000000b0e36f00d0bbe9705792b166fefffffff0e06f008a91e870a0e06f000000000000000000a391e8701ce16f000000000000000000000000000000000000000000000000000100000000000000010000000000000018e16f000000000028e16f00000000001ce16f000000000000000000000000004b0061760be2351630e16f0084da01744dc2b45934e16f00dab9017400009b7228e16f00 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000080cf930038cffc76f434ab02eccf930001000000a834ab02f434ab02a834ab02040000000400000000e00d7400100000eccf930001000000a834ab02cd97fc769c97fc7691017e65b50f0474a834ab020000fc76000000000c137a730000000080ee0a740100000000000000f8e20d7400000000040000000000000048400c74f8e20d74f0cf930080e81376209bab0280e81376eccf93000000000080e8137600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000de67ae02f467ae02 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce84ae02e684ae02 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d684ae02ea84ae02 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b68dae02ce8dae02 (UID: 00000000-00008668)2b:T49b,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")2c:T53e,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Windows Sessions Start.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Windows Sessions Start.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2d:T4d0,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp")2e:T49b,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")2f:T936,Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "11757483494,4544,105,,GetForegroundWindow,user32.dll,"00:29:34.625",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00004436.00000000.113579.033F0000.00000004.mdmp") Found reference to API "83391722368,4544,105,,GetForegroundWindow,user32.dll,"00:30:04.484",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00004436.00000001.115496.033F0000.00000004.mdmp") Found reference to API "155579047781,4544,105,,GetForegroundWindow,user32.dll,"00:30:34.562",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00004436.00000002.117416.033F0000.00000004.mdmp") Found reference to API "143729086355,4544,105,,GetForegroundWindow,user32.dll,"00:30:29.625",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00004436.00000002.117416.033F0000.00000004.mdmp")30:T8e4,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" queries volume information of "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" at 00000000-00001008-00000C16-757737711 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00001008-00000C16-757963012 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00001008-00000C16-758166942 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00001008-00000C16-759256386 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00001008-00000C16-762881850 "Windows Sessions Start.exe" queries volume information of "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe" at 00000000-00004956-00000C16-776129613 "Windows Sessions Start.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00004956-00000C16-776317767 "Windows Sessions Start.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00004956-00000C16-776453003 "Windows Sessions Start.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00004956-00000C16-777403254 "Windows Sessions Start.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00004956-00000C16-78014867231:T4974,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00008668) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004492) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004492) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004492) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004492) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004956) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004436) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004436) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004436) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004436) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00004436) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004436) "Windows Sessions Start.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00004436)32:T18656,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00008668) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00008668) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004492) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004492) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004956) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00004436) "Windows Sessions Start.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00004436)33:T17e5a,Found reference to API (Indicator: "GetObject"; File: "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d") Found reference to API (Indicator: "MessageBox"; File: "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp, 00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp, 00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFileEx"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLongPathNameA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "FindWindowA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SetWindowsHookExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutNameA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseWindow"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegisterClassExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "Shell_NotifyIconA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "ExtractIconA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "PathFileExistsA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "URLDownloadToFileA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004436.00000002.117416.00C72000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00004436.00000002.117416.00C72000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp, 00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004956.00000000.113191.6E765000.00000002.mdmp")34:T919,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp")35:Tba4,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")36:T563,Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp")37:Tc49,"Software\Classes\mscfile\shell\open\command" in Source: 00000000-00004436.00000000.113579.00400000.00000040.mdmp 00000000-00004436.00000001.115496.00400000.00000040.mdmp 00000000-00004436.00000002.117416.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00004436.00000000.113579.00400000.00000040.mdmp 00000000-00004436.00000001.115496.00400000.00000040.mdmp 00000000-00004436.00000002.117416.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\" in Source: 00000000-00004436.00000000.113579.00400000.00000040.mdmp 00000000-00004436.00000001.115496.00400000.00000040.mdmp 00000000-00004436.00000002.117416.00400000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" in Source: 00000000-00004436.00000000.113579.00400000.00000040.mdmp 00000000-00004436.00000001.115496.00400000.00000040.mdmp 00000000-00004436.00000002.117416.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00004436.00000000.113579.00400000.00000040.mdmp 00000000-00004436.00000001.115496.00400000.00000040.mdmp 00000000-00004436.00000002.117416.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004436.00000000.113579.00400000.00000040.mdmp 00000000-00004436.00000001.115496.00400000.00000040.mdmp 00000000-00004436.00000002.117416.00400000.00000040.mdmp "Software\" in Source: 00000000-00004436.00000000.113579.00400000.00000040.mdmp 00000000-00004436.00000001.115496.00400000.00000040.mdmp 00000000-00004436.00000002.117416.00400000.00000040.mdmp "/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00004436.00000000.113579.00400000.00000040.mdmp 00000000-00004436.00000001.115496.00400000.00000040.mdmp 00000000-00004436.00000002.117416.00400000.00000040.mdmp "Software\Windows Audio" in Source: 00000000-00004436.00000000.113579.04F30000.00000004.mdmp "Software\Windows Audio\" in Source: 00000000-00004436.00000000.113579.04F30000.00000004.mdmp 00000000-00004436.00000001.115496.04F30000.00000004.mdmp 00000000-00004436.00000002.117416.04F30000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004956.00000000.113191.02AE0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004956.00000000.113191.02AE0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp "HKLM\" in Source: 00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp38:T9e3,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:ffffffffc0000135] "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "Windows Sessions Start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "Windows Sessions Start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "Windows Sessions Start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "Windows Sessions Start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "Windows Sessions Start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:ffffffffc0000135] "Windows Sessions Start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135]39:T43ee,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "KERNEL32" at base 75ed0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76ed0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 724d0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "ADVAPI32.DLL" at base 76f00000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 723a0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "SHLWAPI.DLL" at base 75e80000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76d10000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "VERSION.DLL" at base 735d0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71bf0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "USER32.DLL" at base 76710000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "MSCOREE.DLL" at base 72520000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76890000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "PSAPI.DLL" at base 76010000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "RPCRT4.DLL" at base 741a0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "KERNEL32.DLL" at base 75ed0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fa60000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "OLE32.DLL" at base 73940000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73360000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76890000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71a90000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71030000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "UXTHEME.DLL" at base 73360000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f240000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 70f20000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6eac0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "NTDLL.DLL" at base 76f80000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "SHELL32.DLL" at base 74650000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "BCRYPT.DLL" at base 72680000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 70ef0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "IMM32.DLL" at base 76ed0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "COMCTL32.DLL" at base 6ea30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "GDI32.DLL" at base 75ab0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "GDIPLUS.DLL" at base 73640000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73640000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 73f30000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "WLDP.DLL" at base 70ed0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "AMSI.DLL" at base 6e7a0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 735d0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6e750000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e6b0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75ed0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "USERENV.DLL" at base 6e770000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76f00000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "WINDOWSCODECS.DLL" at base 729b0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "NTDLL" at base 76f80000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72e00000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76020000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72360000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74650000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 731a0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "MSISO.DLL" at base 72300000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "SSPICLI.DLL" at base 738a0000 "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 73f30000 "cmd.exe" loaded module "KERNEL32" at base 75ed0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 73f30000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 73f30000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 73f30000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76ed0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73f30000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73f30000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73f30000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 724d0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75ed0000 "cmd.exe" loaded module "NTDLL.DLL" at base 76f80000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73800000 "Windows Sessions Start.exe" loaded module "KERNEL32" at base 75ed0000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 73f30000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 73f30000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 73f30000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76ed0000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73f30000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73f30000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73f30000 "Windows Sessions Start.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 724d0000 "Windows Sessions Start.exe" loaded module "ADVAPI32.DLL" at base 76f00000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 723a0000 "Windows Sessions Start.exe" loaded module "SHLWAPI.DLL" at base 75e80000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76d10000 "Windows Sessions Start.exe" loaded module "VERSION.DLL" at base 735d0000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71bf0000 "Windows Sessions Start.exe" loaded module "USER32.DLL" at base 76710000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 73f30000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Windows Sessions Start.exe" loaded module "MSCOREE.DLL" at base 72520000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76890000 "Windows Sessions Start.exe" loaded module "PSAPI.DLL" at base 76010000 "Windows Sessions Start.exe" loaded module "RPCRT4.DLL" at base 741a0000 "Windows Sessions Start.exe" loaded module "KERNEL32.DLL" at base 75ed0000 "Windows Sessions Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fa60000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Windows Sessions Start.exe" loaded module "OLE32.DLL" at base 73940000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73360000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76890000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73f30000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71a90000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "Windows Sessions Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71030000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "Windows Sessions Start.exe" loaded module "UXTHEME.DLL" at base 73360000 "Windows Sessions Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f240000 "Windows Sessions Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 70f20000 "Windows Sessions Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6eac0000 "Windows Sessions Start.exe" loaded module "NTDLL.DLL" at base 76f80000 "Windows Sessions Start.exe" loaded module "SHELL32.DLL" at base 74650000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Windows Sessions Start.exe" loaded module "BCRYPT.DLL" at base 72680000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 70ef0000 "Windows Sessions Start.exe" loaded module "IMM32.DLL" at base 76ed0000 "Windows Sessions Start.exe" loaded module "COMCTL32.DLL" at base 6ea30000 "Windows Sessions Start.exe" loaded module "GDI32.DLL" at base 75ab0000 "Windows Sessions Start.exe" loaded module "GDIPLUS.DLL" at base 73640000 "Windows Sessions Start.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73640000 "Windows Sessions Start.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 73f30000 "Windows Sessions Start.exe" loaded module "WLDP.DLL" at base 70ed0000 "Windows Sessions Start.exe" loaded module "AMSI.DLL" at base 6e7a0000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 735d0000 "Windows Sessions Start.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6e750000 "Windows Sessions Start.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e6b0000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75ed0000 "Windows Sessions Start.exe" loaded module "USERENV.DLL" at base 6e770000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76f00000 "Windows Sessions Start.exe" loaded module "WINDOWSCODECS.DLL" at base 729b0000 "Windows Sessions Start.exe" loaded module "NTDLL" at base 76f80000 "Windows Sessions Start.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72530000 "Windows Sessions Start.exe" loaded module "SSPICLI.DLL" at base 738a0000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 725b0000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72510000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 724f0000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 724d0000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72420000 "Windows Sessions Start.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72410000 "Windows Sessions Start.exe" loaded module "%WINDIR%\MICROSOFT MEDIA SESSION\WINDOWS SESSIONS START.EXE" at base 4000003a:T91b,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")3b:T956,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Windows Sessions Start.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3c:T962,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3d:Td35,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001008-00000C29-756810502] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001008-00000C29-757186821] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001008-00000C29-757318792] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001008-00000C29-757395236] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001008-00000C29-757696507] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001008-00000C29-757738929] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001008-00000C29-757804706] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001008-00000C29-757929403] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001008-00000C29-758034163] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001008-00000C29-758110866] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001008-00000C29-758271242] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001008-00000C29-758417713] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001008-00000C29-758448741] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001008-00000C29-758524981] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001008-00000C29-758827577] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001008-00000C29-760243399] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00001008-00000C29-760664294] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001008-00000C29-761152183] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001008-00000C29-762454445] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001008-00000C29-762488223] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001008-00000C29-762528025] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001008-00000C29-763431671]3e:T5a2,Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")3f:T42d,"Windows Sessions Start.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%WINDIR%\Microsoft Media Session\Windows Sessions Start.exe]- [targetUID: 00000000-00004492] "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe.log]- [targetUID: 00000000-00001008] "install.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\install.bat]- [targetUID: 00000000-00004492] "logs.dat" has type "data"- Location: [%WINDIR%\Windows Display\logs.dat]- [targetUID: 00000000-00004436] "Windows Sessions Start.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "Windows Sessions Start.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\Windows Sessions Start.exe.log]- [targetUID: 00000000-00004956]40:T7ae,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")41:Te67,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "015DE283D33B7B246204FAD78EAEDE87AB7939AAA34F035D59569AEC3606747D.EXE"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")42:T47f,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"43:T49c,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"44:Tdf4,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll"45:Tc66,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\015DE283D33B7B246204FAD78EAEDE87AB7939AAA34F035D59569AEC3606747D.EXE.CONFIG" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\015DE283D33B7B246204FAD78EAEDE87AB7939AAA34F035D59569AEC3606747D.EXE.LOG" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe.config" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\OQXKIK" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\015DE283D33B7B246204FAD78EAEDE87AB7939AAA34F035D59569AEC3606747D.INI" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.INI" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"46:T6ff,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe.log" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe.log" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" writes file "c:\windows\microsoft media session\windows sessions start.exe" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" writes file "c:\windows\microsoft media session\windows sessions start.exe:zone.identifier" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" writes file "c:\users\%osuser%\appdata\local\temp\install.bat" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" writes file "%windir%\microsoft media session\windows sessions start.exe:zone.identifier" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" writes file "%windir%\microsoft media session\windows sessions start.exe" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" writes file "%temp%\install.bat" "Windows Sessions Start.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\windows sessions start.exe.log" "Windows Sessions Start.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\windows sessions start.exe.log" "Windows Sessions Start.exe" writes file "c:\windows\windows display\logs.dat" "Windows Sessions Start.exe" writes file "%windir%\windows display\logs.dat" "cmd.exe" writes file "%windir%\microsoft media session\windows sessions start.exe"47:T54b,Heuristic match: "gmt;.mr" Heuristic match: "ascoitaliasasummer.duckdns.org" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "* breaking-security.net" Pattern match: "www.instagram.com/justinbieber" Heuristic match: ";.exe;.bat;.cmd;.vbs;.vbe;.js;.jm" Heuristic match: "scoitaliasasummer.duckdns.org" Heuristic match: "taliasasummer.duckdns.org" Heuristic match: "summer.duckdns.org" Heuristic match: "coitaliasasummer.duckdns.org" Heuristic match: "icrosoft.visualstudio.tools.office.runtime.int" Heuristic match: "fice.int" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&"48:Tc7d,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json05/13" - Source: "00000000-00001008.00000000.111983.04BC0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,005/13" - Source: "00000000-00001008.00000000.111983.04BC0000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json05/13" - Source: "00000000-00004956.00000000.113191.071D0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,005/13" - Source: "00000000-00004956.00000000.113191.071D0000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00004956.00000000.113191.07580000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp")49:Teac,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001008) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001008)4a:T1580,Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00001008.00000000.111983.05C00000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00004956.00000000.113191.05D50000.00000004.mdmp, 00000000-00004956.00000000.113191.07550000.00000004.mdmp")4b:Tea7,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001008.00000000.111983.02750000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004956.00000000.113191.02AE0000.00000004.mdmp")4c:T616,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")4d:Td85,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp")4e:T56c,Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "Windows Sessions Start.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "Windows Sessions Start.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "Windows Sessions Start.exe" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "Windows Sessions Start.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "Windows Sessions Start.exe"4f:Tb86,Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")50:Teee,Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004956.00000000.113191.6E765000.00000002.mdmp")51:T472,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp, 00000000-00004956.00000000.113191.6E765000.00000002.mdmp")52:T563,Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")53:T10d1,Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F12]" (Indicator: "[F12]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[End]" (Indicator: "[end]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[Left]" (Indicator: "[left]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[Right]" (Indicator: "[right]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[Down]" (Indicator: "[down]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[Tab]" (Indicator: "[tab]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[Pause]" (Indicator: "[pause]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "[Esc]" (Indicator: "[esc]"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp")54:T57f,Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001008-00000C2A-756914081") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00001008-00000C2A-758567742") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001008-00000C2A-763516168") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00001008-00000C2A-763516253") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")55:T514,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")56:T51c,Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "SHDeleteKeyA" (Indicator: "SHDeleteKey"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")57:T403,Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00001008.00000000.111983.6E751000.00000020.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found string "DisableScriptScanning" (Indicator: "disablescriptscanning"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp") Found string "DisableBlockAtFirstSeen" (Indicator: "disableblockatfirstseen"; Source: "00000000-00004956.00000000.113191.6E6B1000.00000020.mdmp")58:T44e,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")59:T9d4,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")5a:Tf03,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\015DE283D33B7B246204FAD78EAEDE87AB7939AAA34F035D59569AEC3606747D.EXE"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\PING.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT MEDIA SESSION\WINDOWS SESSIONS START.EXE"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT MEDIA SESSION\WINDOWS SESSIONS START.EXE"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Windows Sessions Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "")5b:T408,Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001008.00000000.111983.6E741000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00004436.00000000.113579.00400000.00000040.mdmp, 00000000-00004436.00000001.115496.00400000.00000040.mdmp, 00000000-00004436.00000002.117416.00400000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004956.00000000.113191.6E741000.00000002.mdmp")5c:T635,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" reads file "C:\Users\desktop.ini"5d:T60e,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "WINDOWS SOUNDS ENDPOINTS"; Value: ""%WINDIR%\Microsoft Media Session\Windows Sessions Start.exe"") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "WINDOWS SOUNDS ENDPOINTS"; Value: ""%WINDIR%\Microsoft Media Session\Windows Sessions Start.exe"") "Windows Sessions Start.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "Windows Sessions Start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "WINDOWS SOUNDS ENDPOINTS"; Value: ""%WINDIR%\Microsoft Media Session\Windows Sessions Start.exe"") "Windows Sessions Start.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "Windows Sessions Start.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "WINDOWS SOUNDS ENDPOINTS"; Value: ""%WINDIR%\Microsoft Media Session\Windows Sessions Start.exe"")5e:T72b,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" wrote 00000004 bytes to a remote process "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Handle: 1288) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" wrote 00000004 bytes to a remote process "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Handle: 1292) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" wrote 00001000 bytes to a remote process "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Handle: 1292) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" wrote 0000F000 bytes to a remote process "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Handle: 1292) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" wrote 00005000 bytes to a remote process "C:\015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" (Handle: 1292) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 400) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe" (Handle: 392) "Windows Sessions Start.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe" (Handle: 1308) "Windows Sessions Start.exe" wrote 00001000 bytes to a remote process "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe" (Handle: 1308) "Windows Sessions Start.exe" wrote 0000F000 bytes to a remote process "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe" (Handle: 1308) "Windows Sessions Start.exe" wrote 00005000 bytes to a remote process "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe" (Handle: 1308)5f:Td47,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00002104.00000000.67376.01BC0000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")60:Te8f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002792-00000C25-20240693] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002792-00000C25-20387814] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002792-00000C25-20892596] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002792-00000C25-20942354] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002792-00000C25-21102412] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002792-00000C25-21151878] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002792-00000C25-21195556] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002792-00000C25-21356514] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002792-00000C25-21435606] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002792-00000C25-21469966] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002792-00000C25-21511925] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002792-00000C25-21681213] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002792-00000C25-21702473] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002792-00000C25-21747888] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002792-00000C25-21784798] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002792-00000C25-22066061] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00002792-00000C25-22442019] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002792-00000C25-22923847] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00002792-00000C25-22992682] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00002792-00000C25-23040333] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00002792-00000C25-23311445] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00002792-00000C25-24944074] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002792-00000C25-26563432]61:Teac,"015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00002792) "015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002792)62:T502,Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_iexplor") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_iexplor") Found string "" (Indicator: "github.com")64:T64d,Found string "" (Indicator: "text/javascript"; File: "1FN2LTPF.htm") Found string "" (Indicator: "text/javascript"; File: "1FN2LTPF.htm") Found string "" (Indicator: "text/javascript"; File: "1FN2LTPF.htm") Found string "" (Indicator: "text/javascript"; File: "1FN2LTPF.htm") Found string "