24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 01883bb1f707… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 01883bb1f707…. Malware family: Trojan.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/01883bb1f70794db7c3fea5e5f7897a39e165c7fbccb5d4ef635227d1178c60a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","01883bb1f70794db7c3fea5e5f7897a39e165c7fbccb5d4ef635227d1178c60a"],"about":{"@type":"SoftwareApplication","name":"a6000858b4fa31bf046b12b93b9f31f9.exe","applicationCategory":["peexe","executable"],"identifier":"01883bb1f70794db7c3fea5e5f7897a39e165c7fbccb5d4ef635227d1178c60a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T199e,"a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef72187def7200000000d0a96f750000687590116975200b5500b07154001820550040f41b00feffffffe8f61b00506a8c77f75d41c5feffffff00f51b00eaa98877200b55000000000018205500a11400000a000b00b297ef725c76ef726876ef7218205500602b5600140000000000000000000000200b550028f51b00cc2d8d7718205500000000002420550000000000f800e87200000000cc0d24385ce88b7768408a7718020000190000001100000010000000d0b4540060f51b008d9a1e7498b354000c2755000000000080f51b00a4b054000c27550098f51b000000e872feffffff0400000020af1e7400000000000000000300000088f51b00 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078be1b0038cf8977b4245400e4be1b000100000068245400b424540068245400040000000400000000e0907600100000e4be1b000100000068245400cd9789779c9789777369ceb2b50f8776682454000000897700000000142475760000000080ee8d760100000000000000f8e29076000000000400000080a91e7448408f76f8e29076e8be1b0080e83977800c550080e83977e4be1b000000000080e8397700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000467356005c735600 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000006ff58001eff5800 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002ea6580042a65800 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007e22590096225900 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000567556006c755600 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000361c59004e1c5900 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000036c558004ec55800 (UID: 00000000-00006268)26:T4ae,"a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e53b8007340b80008fe1b00a040b800bcfd1b00e4f8b80011000000ac72b8000000000010000000e4f8b80011000000ac72b800a04cb80006000000024eb800060000005a4eb800016eb800468db80008fe1b00214eb80014fe1b0078049704e4f8b80011000000060000004593b800 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000005400d0fd1b003800000000000000165ca2008f42a20008fe1b00bc42a200bcfd1b00483db300a700000054aea200ee13897710000000483db300a700000054aea2003c53a2000e000000fa56a2000e0000005257a20001a9a2007e07a30008fe1b001957a20014fe1b005c04af04483db300a70000000e000000c50da300 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000002757008baa1f7788aa550046a3b800cce78b770677a7007802000000000000000000000000000020fc1b0014fd1b0046a3b800b7a3b800000000009826af042000000028fc1b00bb42a200cc75b50046a3b800b7a3b8009c26af04020000003c27af0484fe1b0034fc1b009c26af0401000000000000009c5ba70046020000 (UID: 00000000-00006268)27:T4eb,"a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter C:\a6000858b4fa31bf046b12b93b9f31f9.ENU (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter C:\a6000858b4fa31bf046b12b93b9f31f9.EN (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00006268)28:T168c9,"a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThreadLocale (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WritePrivateProfileStringW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WritePrivateProfileStringA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VirtualUnlock (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VirtualLock (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetThreadPriority (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetThreadLocale (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter QueryDosDeviceW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MapViewOfFileEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsBadWritePtr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsBadStringPtrW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalReAlloc (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalHandle (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalFindAtomA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalDeleteAtom (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GlobalAddAtomA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThreadPriority (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTempFileNameA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetStringTypeExW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetStringTypeExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetPrivateProfileStringW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetPrivateProfileStringA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDateFormatA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FreeResource (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindResourceW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FileTimeToLocalFileTime (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FileTimeToDosDateTime (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnumCalendarInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CompareStringA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsBadStringPtrA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetKeyboardType (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadStringA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharNextA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WinHelpA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VkKeyScanW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter UnregisterClassA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter UnhookWindowsHookEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TranslateMDISysAccel (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter TrackPopupMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SystemParametersInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ShowScrollBar (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ShowOwnedPopups (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ShowCursor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowsHookExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowTextA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowPlacement (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowLongA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetScrollRange (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetScrollPos (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetScrollInfo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetPropA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetParent (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetMenuItemInfoW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetMenuItemInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetClassLongA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetCapture (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetActiveWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ScrollWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RemovePropA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RemoveMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ReleaseCapture (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegisterWindowMessageA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegisterClipboardFormatA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegisterClassA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PtInRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PostQuitMessage (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PeekMessageA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter OemToCharA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MapVirtualKeyW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MapVirtualKeyA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadKeyboardLayoutA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadIconA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LoadBitmapA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsZoomed (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsRectEmpty (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsDialogMessageA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IntersectRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InsertMenuItemA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InsertMenuA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InflateRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowLongA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTopWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSysColorBrush (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSubMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetScrollRange (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetScrollPos (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetScrollInfo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetPropA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMessagePos (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMenuStringW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMenuStringA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMenuState (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMenuItemInfoW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMenuItemInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMenuItemID (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMenuItemCount (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetLastActivePopup (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetKeyNameTextW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetKeyNameTextA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCursor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetClassNameA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetClassInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FrameRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindWindowW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FindWindowA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EqualRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnableScrollBar (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawTextA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawMenuBar (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawIconEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawIcon (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawFrameControl (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawEdge (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DestroyMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DestroyCursor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DeleteMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DefMDIChildProcW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DefMDIChildProcA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DefFrameProcW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DefFrameProcA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreatePopupMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateMenu (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateMDIWindowW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateIcon (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ChildWindowFromPoint (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CheckMenuItem (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharUpperBuffW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharLowerBuffW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharLowerW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharLowerBuffA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharLowerA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharUpperA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CharToOemA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ActivateKeyboardLayout (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegOpenKeyA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegFlushKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegDeleteValueA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnumServicesStatusA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SysReAllocStringLen (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SafeArrayPtrOfIndex (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SafeArrayGetUBound (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SafeArrayGetLBound (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SafeArrayCreate (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VariantChangeType (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VariantCopy (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter UnrealizeObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter StretchDIBits (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter StretchBlt (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowOrgEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWinMetaFileBits (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetViewportOrgEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetStretchBltMode (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetROP2 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetPixel (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetPaletteEntries (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetEnhMetaFileBits (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetDIBColorTable (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetBrushOrgEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RoundRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ResizePalette (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Rectangle (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RectVisible (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RealizePalette (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Polyline (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PlayEnhMetaFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PatBlt (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MoveToEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter MaskBlt (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LineTo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IntersectClipRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowOrgEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWinMetaFileBits (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTextMetricsA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32A (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetSystemPaletteEntries (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetPixel (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetPaletteEntries (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetObjectA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetNearestPaletteIndex (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetEnhMetaFilePaletteEntries (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetEnhMetaFileHeader (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetEnhMetaFileBits (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDIBColorTable (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDCOrgEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentPositionEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetClipBox (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetBrushOrgEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetBitmapBits (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GdiFlush (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ExtTextOutA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ExcludeClipRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Ellipse (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DeleteEnhMetaFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreatePenIndirect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreatePalette (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateHalftonePalette (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateFontIndirectA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateDIBitmap (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateBrushIndirect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CopyEnhMetaFileA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ExtractAssociatedIconW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ExtractAssociatedIconA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_SetIconSize (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_GetIconSize (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_Write (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_Read (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_GetDragImage (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_DragShowNolock (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_SetDragCursorImage (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_DragMove (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_DragLeave (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_DragEnter (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_EndDrag (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_BeginDrag (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_Remove (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_DrawEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_Replace (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_Draw (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_GetBkColor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_SetBkColor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_ReplaceIcon (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_Add (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_GetImageCount (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_Destroy (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ImageList_Create (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InitCommonControls (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlInitString (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlFreeUnicodeString (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlFormatCurrentUserKeyPath (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlDosPathNameToNtPathName_U (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwProtectVirtualMemory (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter NtOpenSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlInitAnsiString (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlAnsiStringToUnicodeString (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter LdrGetProcedureAddress (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter PathMatchSpecW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwClose (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwSetInformationFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryInformationFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwReadFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwCreateFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwOpenFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryAttributesFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwCreateSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwMapViewOfSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQuerySection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryFullAttributesFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwWriteFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryDirectoryFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwOpenSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwDuplicateObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryVolumeInformationFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwDeleteFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwLockFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwUnlockFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwTerminateProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwOpenKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwEnumerateValueKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryValueKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwCreateKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwEnumerateKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwSetValueKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwDeleteKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwDeleteValueKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwFlushKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwLoadKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwLoadKey2 (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwNotifyChangeKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryMultipleValueKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwReplaceKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwRestoreKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwSaveKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwSetInformationKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwUnloadKey (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwAccessCheck (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwExtendSection (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwFlushBuffersFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwFsControlFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwNotifyChangeDirectoryFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQuerySecurityObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwSetSecurityObject (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwSetVolumeInformationFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwOpenKeyEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwCreateProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwCreateProcessEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwCreateUserProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwResumeThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwCreateThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryInformationProcess (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwQueryVirtualMemory (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwDeviceIoControlFile (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSectionEx (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DebugBreak (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter FatalAppExitA (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter RtlRaiseException (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter NtSetInformationThread (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Heap32ListFirst (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Heap32ListNext (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Heap32First (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Heap32Next (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Toolhelp32ReadProcessMemory (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Module32Next (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Module32FirstW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter Module32NextW (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00006268) "a6000858b4fa31bf046b12b93b9f31f9.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00006268)29:T88e,Found reference to API (Indicator: "GetModuleHandleA"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "GetProcAddress"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "ExitProcess"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "MessageBoxA"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "RegCloseKey"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "SysFreeString"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "CreateFontA"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "a6000858b4fa31bf046b12b93b9f31f9.exe") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006268.00000000.66864.00CA2000.00000040.mdmp")2a:T8d6,"a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76760000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76760000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76760000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "KERNEL32" at base 75b40000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72f10000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "IMM32.DLL" at base 76ab0000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "COMCTL32.DLL" at base 72e80000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "SHFOLDER.DLL" at base 72f60000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73cf0000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "KERNEL32.DLL" at base 75b40000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "RPCRT4.DLL" at base 75850000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "SSPICLI.DLL" at base 74270000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "UXTHEME.DLL" at base 73cf0000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "NTDLL.DLL" at base 77850000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 737c0000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "COMCTL32.DLL" at base 73480000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "USER32.DLL" at base 75680000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "COMCTL32" at base 73480000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76b70000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "OLEAUT32.DLL" at base 771e0000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75680000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75680000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76dc0000 "a6000858b4fa31bf046b12b93b9f31f9.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 770100002b:T673,"a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")2c:Tbe7,"a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "A6000858B4FA31BF046B12B93B9F31F9.EXE"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "a6000858b4fa31bf046b12b93b9f31f9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")2d:T947,"a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\VERSION.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\MSCOREE.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\SHFOLDER.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\SHFolder.dll" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\A6000858B4FA31BF046B12B93B9F31F9.ENU.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\a6000858b4fa31bf046b12b93b9f31f9.ENU.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\A6000858B4FA31BF046B12B93B9F31F9.EN.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\a6000858b4fa31bf046b12b93b9f31f9.EN.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\CLDAPI.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\CLDAPI.dll" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\AEPIC.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\AEPIC.dll" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\BCRYPT.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\bcrypt.dll" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\MRMCORER.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\MrmCoreR.dll" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\iertutil.dll" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\MSVCP110_WIN.DLL" "a6000858b4fa31bf046b12b93b9f31f9.exe" trying to access non-existent file "C:\msvcp110_win.dll"2e:T5d8,Heuristic match: "I03.BV" Heuristic match: "M'N7K.pw" Heuristic match: "~#.rS" Heuristic match: "z+.AM" Pattern match: "http://www.enigmaprotector.com/" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=215117" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "www.onet[1].xml" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "Yg4.YT" Heuristic match: ">h.MR" Heuristic match: "fT3.yt" Heuristic match: "w3.CD" Heuristic match: "Z.cD" Heuristic match: "E-mail : support@enigmaprotector.com" Heuristic match: "ehe3.cA"2f:T10e9,Found URL "http://www.enigmaprotector.com/c:\windows\system32\usercpl.dll%local," - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://www.enigmaprotector.com/icrosoft\windows\inetcache\9c:\users\hapubws\appdata\local\temp\owp8c61.tmp\setup.exe9c:\program" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://www.enigmaprotector.com/:\programdata\microsoft\desktop.inicc:\users\hapubws\appdata\local\temp\jds90421.tmp\javasetup8u161.exe\?\volume" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found URL "https://npcap.com/" (Indicator: "GetDC"; Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006268.00000000.66864.00540000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"01883bb1f70794db7c3fea5e5f7897a39e165c7fbccb5d4ef635227d1178c60a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790904335382,"unified_at":"2026-10-02T01:25:35.382Z","metadata":{"hashes":{"sha256":"01883bb1f70794db7c3fea5e5f7897a39e165c7fbccb5d4ef635227d1178c60a","sha1":"1925a00823561414da5b91a9264bc6be9ba91834","md5":"a6000858b4fa31bf046b12b93b9f31f9","sha512":"e5b716ea8568596cb1dd3ac3bbfdabd0321936d53c5c147829ddb192f914560571c68e3e432be3453fa2ac02f1773e7edba3da903ac7f01a5fc36ca52c212a51","ssdeep":"24576:2sypRkcfCs/HzDLJhKQr/VX5qN8kPGA97MI/hS0TaQxP:lc5r3V/VXYnzlv","ssdeep_chunks":["24576:2sypRkc","24576:sypRkcf","24576:ypRkcfC","24576:pRkcfCs","24576:RkcfCs/","24576:kcfCs/H","24576:cfCs/Hz","24576:fCs/HzD","24576:Cs/HzDL","24576:s/HzDLJ","24576:/HzDLJh","24576:HzDLJhK","24576:zDLJhKQ","24576:DLJhKQr","24576:LJhKQr/","24576:JhKQr/V","24576:hKQr/VX","24576:KQr/VX5","24576:Qr/VX5q","24576:r/VX5qN","24576:/VX5qN8","24576:VX5qN8k","24576:X5qN8kP","24576:5qN8kPG","24576:qN8kPGA","24576:N8kPGA9","24576:8kPGA97","24576:kPGA97M","24576:PGA97MI","24576:GA97MI/","24576:A97MI/h","24576:97MI/hS","24576:7MI/hS0","24576:MI/hS0T","24576:I/hS0Ta","24576:/hS0TaQ","24576:hS0TaQx","24576:S0TaQxP","49152:2sypRkc","49152:sypRkcf","49152:ypRkcfC","49152:pRkcfCs","49152:RkcfCs/","49152:kcfCs/H","49152:cfCs/Hz","49152:fCs/HzD","49152:Cs/HzDL","49152:s/HzDLJ","49152:/HzDLJh","49152:HzDLJhK","49152:zDLJhKQ","49152:DLJhKQr","49152:LJhKQr/","49152:JhKQr/V","49152:hKQr/VX","49152:KQr/VX5","49152:Qr/VX5q","49152:r/VX5qN","49152:/VX5qN8","49152:VX5qN8k","49152:X5qN8kP","49152:5qN8kPG","49152:qN8kPGA","49152:N8kPGA9","49152:8kPGA97","49152:kPGA97M","49152:PGA97MI","49152:GA97MI/","49152:A97MI/h","49152:97MI/hS","49152:7MI/hS0","49152:MI/hS0T","49152:I/hS0Ta","49152:/hS0TaQ","49152:hS0TaQx","49152:S0TaQxP","24576:lc5r3V/","24576:c5r3V/V","24576:5r3V/VX","24576:r3V/VXY","24576:3V/VXYn","24576:V/VXYnz","24576:/VXYnzl","24576:VXYnzlv"],"imphash":"2e5467cba76f44a088d39f78c5e807b6"},"file_info":{"file_name":"a6000858b4fa31bf046b12b93b9f31f9.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1133056,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706187442000,"last_seen":1706187442000,"last_multi_scan":1706187442000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bladabindi","njrat","rat","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":66,"suspicious_count":9,"malicious_count":1,"total":76},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.RL_Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.EnigmaProtector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1314138","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.71283867","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Bladabindi-9854975-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.71283867 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.EnigmaProtector.J suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005835da1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXLU-JT!A6000858B4FA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject3.khkbnd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.FFG.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Zpevdo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006268.00000000.66864.00540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.988139511375628","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"EnumWindows\" with parameter \"1834480\" - (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetWindowTextA\" (UID: 00000000-00006268)\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetWindowTextA\" with parameter \"Network Flyout\" - (UID: 00000000-00006268)\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetWindowTextA\" with parameter \"%PROGRAMFILES%\\mitmproxy\\bin\\mitmdump.exe\" - (UID: 00000000-00006268)\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetWindowTextA\" with parameter \"AutoIt v3\" - (UID: 00000000-00006268)\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetWindowTextA\" with parameter \"%PROGRAMFILES%\\Wireshark\\dumpcap.exe\" - (UID: 00000000-00006268)\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetWindowTextA\" with parameter \"%PROGRAMFILES%\\Wireshark\\tshark.exe\" - (UID: 00000000-00006268)\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetWindowTextA\" with parameter \"Microsoft OneNote 2010 - Windows taskbar\" - (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetActiveWindow\" (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: a6000858b4fa31bf046b12b93b9f31f9.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00006268.00000000.66864.00540000.00000004.mdmp\n \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00006268.00000000.66864.00540000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Enigma Protector\\%.8x%.8x-%.8x%.8x\" in Source: 00000000-00006268.00000000.66864.00540000.00000004.mdmp\n 00000000-00006268.00000000.66864.04B30000.00000040.mdmp\n \"Software\\Enigma Protector\\29AEB4A0365755F6-B862CAE984EA4D0E\" in Source: 00000000-00006268.00000000.66864.00540000.00000004.mdmp\n \"Software\\Wow6432`\" in Source: 00000000-00006268.00000000.66864.00540000.00000004.mdmp\n \"Software\\Wow6432\" in Source: 00000000-00006268.00000000.66864.00540000.00000004.mdmp\n \"sSoftware\\Wow6432\" in Source: 00000000-00006268.00000000.66864.00540000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00006268.00000000.66864.00540000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:6268:64:WilError_01\"\n \"Local\\SM0:6268:168:WilStaging_02\"\n \"SM0:6268:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76CC0000\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72FE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75850000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" was detected as \"ENIGMA\" and name: \"Protector\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" touched \"Private Profile Object\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{75847177-F077-4171-BD2C-A6BB2164FBD0}\\INPROCSERVER32\")\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" touched \"Local Icon Cache\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{2155FEE3-2419-4373-B102-6843707EB41F}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" has an executable section named \"\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" has an executable section named \".rsrc\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" has an executable section named \"booga\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" has an writable section named \"\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" has an writable section named \".rsrc\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" has an writable section named \"booga\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" file has an entrypoint instructions - \"call\t0x404802,jmp\t0x40461f,push\t0x44bb60,push\tdword ptr fs:[0],mov\teax, dword ptr [esp + 0x10],mov\tdword ptr [esp + 0x10], ebp,lea\tebp, [esp + 0x10],sub\tesp, eax,push\tebx,push\tesi,push\tedi,mov\teax, dword ptr [0x466ecc],xor\tdword ptr [ebp - 4], eax,xor\teax, ebp,push\teax,mov\tdword ptr [ebp - 0x18], esp,push\tdword ptr [ebp - 8],mov\teax, dword ptr [ebp - 4],mov\tdword ptr [ebp - 4], 0xfffffffe,mov\tdword ptr [ebp - 8], eax,lea\teax, [ebp - 0x10],mov\tdword ptr fs:[0], eax,ret\t,mov\tecx, dword ptr [ebp - 0x10],mov\tdword ptr fs:[0], ecx,pop\tecx,pop\tedi,pop\tedi,pop\tesi,pop\tebx,mov\tesp, ebp,pop\tebp,push\tecx,ret\t,int3\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x280000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" searching for class \"OLLYDBG\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" queries basic process information of the \"C:\\a6000858b4fa31bf046b12b93b9f31f9.exe\" (UID: 6268)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\a6000858b4fa31bf046b12b93b9f31f9.exe\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\iconcache.db\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\a6000858b4fa31bf046b12b93b9f31f9.exe\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\VERSION.DLL\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\version.dll\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\MSCOREE.DLL\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to access non-existent file \"C:\\A6000858B4FA31BF046B12B93B9F31F9.EXE.LOCAL\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to access non-existent file \"C:\\a6000858b4fa31bf046b12b93b9f31f9.exe.Local\\\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to access non-existent file \"C:\\A6000858B4FA31BF046B12B93B9F31F9.ENU\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to access non-existent file \"C:\\a6000858b4fa31bf046b12b93b9f31f9.ENU\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to access non-existent file \"C:\\A6000858B4FA31BF046B12B93B9F31F9.EN\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to access non-existent file \"C:\\a6000858b4fa31bf046b12b93b9f31f9.EN\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.DLL.CONFIG\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"\"5fmx.\" [Source: 00000000-00006268.00000000.66864.00CA2000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.1.32.0\"\n \"17.005.0107.0008\"\n \"2.13.0.0\"\n \"3.3.14.3\"\n \"2.53.0.0\"\n \"5.2.24.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$2f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"6268\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetComputerNameA\" (UID: 00000000-00006268)\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetComputerNameW\" (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetUserNameA\" (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"FindFirstFileW\" with parameter C:\\a6000858b4fa31bf046b12b93b9f31f9.exe (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"/OaeS%\" (Indicator: \"aes\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found string \"AES3\" (Indicator: \"aes\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")\n Found string \"TAES_Wr(ap\" (Indicator: \"aes\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")\n Found string \"%YhAeSWY\" (Indicator: \"aes\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")\n Found string \"pHhX~AeS\" (Indicator: \"aes\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")\n Found string \"/* RIJNDAEL by Joan Daemen and Vincent Rijmen */\" (Indicator: \"rijndael\"; Source: \"00000000-00006268.00000000.66864.04AF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006268.00000000.66864.00540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"a6000858b4fa31bf046b12b93b9f31f9.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006268.00000000.66864.00CA2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" was detected as \"Safeguard v1.03 -> Simonzh\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" at 00000000-00006268-00000C13-35811844","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" queried SystemProcessInformation at 00000000-00006268-00000C13-35110933 [PID: 6268]\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" queried SystemProcessInformation at 00000000-00006268-00000C13-35112385 [PID: 6268]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"???\n ???\n booga with unusual entropies 7.97371583838\n 7.99812456845\n 7.98546534686","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"FileTimeToLocalFileTime\" with parameter 90aeccbfd14fda01 & 906ea9b18e4fda01 (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n GetProcAddress\n GetModuleHandleA\n LoadLibraryA\n ShellExecuteA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"a6000858b4fa31bf046b12b93b9f31f9.exe\" has a section named \"\"\n \"a6000858b4fa31bf046b12b93b9f31f9.exe\" has a section named \"booga\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["bladabindi","njrat","rat","evasive","windows-server-utility"],"sandbox_reports":[{"id":"65b25ab116fad4c8bc05930c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"a6000858b4fa31bf046b12b93b9f31f9.exe","analysis_start_time":"2024-01-25T12:59:54+00:00","indicators_count":{"informative":66,"suspicious":16,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}],"processes":[{"pid":6268,"ppid":0,"name":"a6000858b4fa31bf046b12b93b9f31f9.exe","command_line":"","sha256":"01883bb1f70794db7c3fea5e5f7897a39e165c7fbccb5d4ef635227d1178c60a","normalized_path":"C:\\a6000858b4fa31bf046b12b93b9f31f9.exe","uid":"00000000-00006268","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["TextInputFramework.dll","ntmarta.dll","ntdll.dll","profapi.dll","fltLib.dll","CoreUIComponents.dll","policymanager.dll","sspicli.dll","kernel.appcore.dll","version.dll","ws2_32.dll","bcrypt.dll","clbcatq.dll","propsys.dll","wow64cpu.dll","sechost.dll","msctf.dll","cldapi.dll","aepic.dll","shell32.dll","cryptsp.dll","msvcp110_win.dll","gdi32full.dll","rpcrt4.dll","uxtheme.dll","KernelBase.dll","ucrtbase.dll","dwmapi.dll","WinTypes.dll","msvcrt.dll","cryptbase.dll","cfgmgr32.dll","SHCore.dll","mscoree.dll","kernel32.dll","advapi32.dll","combase.dll","MrmCoreR.dll","wow64win.dll","user32.dll","bcryptprimitives.dll","VxSSL32.dll","wow64.dll","win32u.dll","msvcp_win.dll","powrprof.dll","shfolder.dll","gdi32.dll","windows.storage.dll","apphelp.dll","iertutil.dll","ole32.dll","WindowsCodecs.dll","oleaut32.dll","shlwapi.dll","imm32.dll","comctl32.dll","CoreMessaging.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:6268:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"name":"Local\\SM0:6268:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]},{"name":"SM0:6268:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b25ab116fad4c8bc05930c"}]}]}},"report_ids":{"sandbox_job_ids":["65b25ab116fad4c8bc05930c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 01883bb1f707… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 01883bb1f707…. Malware family: Trojan.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/01883bb1f70794db7c3fea5e5f7897a39e165c7fbccb5d4ef635227d1178c60a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 01883bb1f707… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 01883bb1f707…. Malware family: Trojan.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/01883bb1f70794db7c3fea5e5f7897a39e165c7fbccb5d4ef635227d1178c60a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 01883bb1f707… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 01883bb1f707…. Malware family: Trojan.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]