xlcq decrypt

24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 0210a8f8e729… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0210a8f8e729…. Malware family: Trojan.Agent. Threat score 100/100. 20/24 AV engines flagged this file. 12 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3"],"about":{"@type":"SoftwareApplication","name":"20160321_tos.scr","applicationCategory":["peexe","executable"],"identifier":"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":20,"total":24},"behavioralIndicators":{"malicious":12,"suspicious":40},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T594,"" wrote bytes "1099c87500000000653c0877c855077700000000d0bbc6768012c776d62d087700000000" to virtual address "0x6F931000" (part of module "KSUSER.DLL") "" wrote bytes "4053067758580777186a0777653c08770000000000bfc6760000000056ccc676000000007ccac67600000000376820756a2c0877d62d087700000000206920750000000029a6c67600000000a48d207500000000f70ec67600000000" to virtual address "0x77171000" (part of module "NSI.DLL") "WINWORD.EXE" wrote bytes "2655e53e" to virtual address "0x663BF69C" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "e92319b3f0" to virtual address "0x76C73D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "2e5cf826" to virtual address "0x688DE718" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "6179bd26" to virtual address "0x2F801634" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "d5201726" to virtual address "0x6978EC08" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "4053067758580777186a0777653c08770000000000bfc6760000000056ccc676000000007ccac67600000000376820756a2c0877d62d087700000000206920750000000029a6c67600000000a48d207500000000f70ec67600000000" to virtual address "0x77171000" (part of module "NSI.DLL") "WINWORD.EXE" wrote bytes "2aa51026" to virtual address "0x67D0A980" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "a7034221" to virtual address "0x675D10AC" (part of module "MSPTLS.DLL")26:T712,"" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "EN-US") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "AR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "AR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "AR-SA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "AR-SA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "BG-BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "BG-BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "CA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "CA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "CA-ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "CA-ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "ZH-HANS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "ZH-HANS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "ZH-CN") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "ZH-CN")27:T767,"" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA")28:T51b,"" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" touched file "C:\Windows\system32\wdmaud.drv" "" touched file "C:\Windows\system32\en-US\SETUPAPI.dll.mui" "" touched file "C:\Windows\system32\en-US\wdmaud.drv.mui" "" touched file "C:\Windows\system32\en-US\MMDevAPI.DLL.mui" "" touched file "C:\Users\qTYBcgA\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\qTYBcgA\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\qTYBcgA\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\system32\en-US\PROPSYS.dll.mui" "" touched file "C:\Windows\system32\rsaenh.dll" "" touched file "C:\Windows\system32\en-US\MPR.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls"29:T2e44," ... saved from url=(0014)about:internet --> xlcq decrypt

WARNING!

Your personal files are encrypted.

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.
Open	http://45jngpxc4cgsxqxc.onion.link or
	http://45jngpxc4cgsxqxc.torstorm.org or
	http://45jngpxc4cgsxqxc.tor2web.org
in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1) Download TOR Browser from http://torproject.org 2) In the Tor Browser open the http://45jngpxc4cgsxqxc.onion (Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable). Write in the following public key in the input from on server: EXRZC-AW0X3-NH7G3-DD2MT-7NQ7H-HS6PG-ADZUC-EX0K2-04BUQ-W1HMU-6HKD7-6TESS-65CAU-PNAXF Q52ZK-JVHXG-ZN0E0-Y8SYN-SHUPF-A6PQJ-DNRJS-HKW8Q-MF7DE-Z6GFC-636WE-8VFH8-DKE0G-ZRYZS XK8E6-PPG85-86EG3-VE8SG-PTWWX-J0J2A-TMVBG-7HDUZ-C72C8-C68WY-YQMF4-UNCEG-EUV7G-TXYMX P5UY2-QW1KG-N6UWX-YQT32-BSSDE-6S8RB-2CEE5-CBKP2-CU0AU-FX753-TAKBB-ZAZSE-GKAS1-X0ZTF MK8UD-66R7A-SSW53-MT74T-U0RS1-HNGGE-J0UAZ-6QDGU-QJDBF-81TNB-VD2GZ-VUGZ8-KTQBW-MBMPX S77XU-5W4JE-4YY13-8QP17-GQ08F-U1X4N-6H7TU-AKWZQ-76G36-DVQFK-QG2QQ-CHGBG

" (Source: _DECRYPT_INFO_xlcq.html, Indicator: "decrypt your files") "

Your personal files are encrypted.
" (Source: _DECRYPT_INFO_xlcq.html, Indicator: "files are encrypted") "Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.
" (Source: _DECRYPT_INFO_xlcq.html, Indicator: "decrypt your files") " ... saved from url=(0014)about:internet --> xlcq decrypt

WARNING!

Your personal files are encrypted.

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.
Open	http://45jngpxc4cgsxqxc.onion.link or
	http://45jngpxc4cgsxqxc.torstorm.org or
	http://45jngpxc4cgsxqxc.tor2web.org
in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1) Download TOR Browser from http://torproject.org 2) In the Tor Browser open the http://45jngpxc4cgsxqxc.onion (Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable). Write in the following public key in the input from on server: EXRZC-AW0X3-NH7G3-DD2MT-7NQ7H-HS6PG-ADZUC-EX0K2-04BUQ-W1HMU-6HKD7-6TESS-65CAU-PNAXF Q52ZK-JVHXG-ZN0E0-Y8SYN-SHUPF-A6PQJ-DNRJS-HKW8Q-MF7DE-Z6GFC-636WE-8VFH8-DKE0G-ZRYZS XK8E6-PPG85-86EG3-VE8SG-PTWWX-J0J2A-TMVBG-7HDUZ-C72C8-C68WY-YQMF4-UNCEG-EUV7G-TXYMX P5UY2-QW1KG-N6UWX-YQT32-BSSDE-6S8RB-2CEE5-CBKP2-CU0AU-FX753-TAKBB-ZAZSE-GKAS1-X0ZTF MK8UD-66R7A-SSW53-MT74T-U0RS1-HNGGE-J0UAZ-6QDGU-QJDBF-81TNB-VD2GZ-VUGZ8-KTQBW-MBMPX S77XU-5W4JE-4YY13-8QP17-GQ08F-U1X4N-6H7TU-AKWZQ-76G36-DVQFK-QG2QQ-CHGBG

" (Source: _DECRYPT_INFO_xlcq.html, Indicator: "decrypt your files")2a:Tc3d,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.00590000.00000004.mdmp, 00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.00590000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API "cdll.LoadLibrary("libc.so.6")" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "self.assertRaises(OSError, cdll.LoadLibrary, "libc.so.9")" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "self.assertRaises(OSError, cdll.LoadLibrary, self.unknowndll)" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "cdll.LoadLibrary(lib)" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "windll.LoadLibrary("kernel32").GetModuleHandleW" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "self.assertRaises(ValueError, windll.LoadLibrary, "kernel32\0")" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "from _ctypes import LoadLibrary, FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "from _ctypes import LoadLibrary, FreeLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "# NOT fit into a 32-bit integer. FreeLibrary must be able" (Indicator: "FreeLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "handle = LoadLibrary("advapi32")" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "FreeLibrary(handle)" (Indicator: "FreeLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp")2b:T22ee,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000003a0328e03a0334e03a0324e03a03000000007b23718fca17ce8c0000040030df438af8df3a03b0e8a9779ae547f8feffffff08e03a03a87b59000000bb7530faa273d447a677c547a6777a28ce8ca4e63a03c47ce6024ae96278fcdf3a0348e33a03b0acb773ffffffff3ce03a0372faa27348e33a037cce947372faa2730100000000000000020000007cce947368e03a03a4e63a03c47ce60280faa2730000000070e03a037c0bd07510aadc759ed66278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000e4020000000088000000cce13a03000059000000000000000000000000000000000000000000000000002000000010000f00e070e6022076e602b1caa6772076e60200000000280000004200a8734ce13a03000000004ae96278fcdf3a0348e33a03b0acb773ffffffff3ce03a0372faa27314e03a037cce947372faa2730100000000000000020000007cce947368e03a03a4e63a0304b2e60280faa273a294cd752a000000681ee602000000009ed66278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031003a03ca17ce8c34df3a0394df3a035cf43a035c000000b622e602f4e13a03caffa477b622e602e8df3a035c0000009822e60298e23a03f2ffa47700000000000000004ae96278fcdf3a0348e33a03b0acb773ffffffff3ce03a0372faa27314e03a037cce947372faa2730100000000000000020000007cce947368e03a03a4e63a03cce8e60280faa273a294cd7526000000c0bce602000000009ed66278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031003a03ca17ce8c34df3a0394df3a035cf43a035c0000003eeae602f4e13a03caffa4773eeae602e8df3a035c00000020eae60298e23a03f2ffa47700000000000000004ae96278fcdf3a0348e33a03b0acb773ffffffff3ce03a0372faa27314e03a037cce947372faa2730100000000000000020000007cce947368e03a03a4e63a0304fee60280faa273a294cd752900000020eae602000000009ed66278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031003a03ca17ce8c34df3a0394df3a035cf43a035c000000c623e602f4e13a03caffa477c623e602e8df3a035c000000a823e60298e23a03f2ffa47700000000000000004ae96278fcdf3a0348e33a03b0acb773ffffffff3ce03a0372faa27314e03a037cce947372faa2730100000000000000020000007cce947368e03a03a4e63a033c0ae70280faa273a294cd7527000000f8b8e602000000009ed66278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031003a03ca17ce8c34df3a0394df3a035cf43a035c000000c623e602f4e13a03caffa477c623e602e8df3a035c000000a823e60298e23a03f2ffa47700000000000000004ae96278fcdf3a0348e33a03b0acb773ffffffff3ce03a0372faa27314e03a037cce947372faa2730100000000000000020000007cce947368e03a03a4e63a033c0ae70280faa273a294cd752a000000e016e702000000009ed66278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031003a03ca17ce8c34df3a0394df3a035cf43a035c0000001e1ee702f4e13a03caffa4771e1ee702e8df3a035c000000001ee70298e23a03f2ffa47700000000000000004ae96278fcdf3a0348e33a03b0acb773ffffffff3ce03a0372faa27314e03a037cce947372faa2730100000000000000020000007cce947368e03a03a4e63a03d420e70280faa273a294cd7529000000801ce702000000009ed66278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022ef6278a4d93a03f0dc3a03b0acb773ffffffffe4d93a0372faa273000000007cce947372faa2730100000000000000020000007cce947310da3a034ce03a037c4ae70280faa2730000000000000000000000000000000076ef6278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022ef6278a4d93a03f0dc3a03b0acb773ffffffffe4d93a0372faa273000000007cce947372faa2730100000000000000020000007cce947310da3a034ce03a03f44ce70280faa2730000000000000000000000000000000076ef6278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022ef6278a4d93a03f0dc3a03b0acb773ffffffffe4d93a0372faa273000000007cce947372faa2730100000000000000020000007cce947310da3a034ce03a032c4ee70280faa2730000000000000000000000000000000076ef6278 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022ef6278a4d93a03f0dc3a03b0acb773ffffffffe4d93a0372faa273000000007cce947372faa2730100000000000000020000007cce947310da3a034ce03a032c95e80280faa2730000000000000000000000000000000076ef6278 (UID: 00000000-00001700)2c:T54c,Found reference to API "7941148590,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7946906124,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7946431400,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7945951096,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7947913280,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7948382640,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7947435318,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp")2d:T7e5,Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API "7941148590,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7946906124,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7946431400,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7945951096,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7947913280,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7948382640,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp") Found reference to API "7947435318,6876,100,,FindWindowExW,user32.dll,"00:59:38.718",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00001700.00000000.229138.00590000.00000004.mdmp")2e:T9b2,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ".RTF"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ".RTF"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: "HIDDEN"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\FILEASSOCIATIONS"; Key: ".RTF"; Value: "")2f:T13f2,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter SHLWAPI.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter SETUPAPI.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter SHELL32.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter CRYPT32.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter NTDLL.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter msiltcfg.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter srpapi.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SFC.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SXS.DLL (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "LoadLibrary" with a parameter mpr.dll (UID: 00000000-00001700)30:T8e49,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter wnsprintfA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter wnsprintfW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter StrStrIA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetupIterateCabinetW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiSetInternalUI (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiConfigureProductExW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiProvideComponentFromDescriptorW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiDecomposeDescriptorW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiGetProductInfoW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiAdvertiseScriptW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiQueryProductStateW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiIsProductElevatedW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiReinstallProductW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CloseWindowStation (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiGetComponentPathW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiQueryFeatureStateW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MsiQueryFeatureStateFromDescriptorW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SrpOpenTrackInstall (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SrpCloseTrackInstall (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SfcIsKeyProtected (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ResolveDelayLoadsFromDll (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateAssemblyCache (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WNetGetLastErrorA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter StrStrA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateFontA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipSetPageUnit (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipDrawImageRect (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipCloneImage (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromStream (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdipAlloc (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter wvnsprintfA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter StrChrA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter DialogBoxParamA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter DestroyMenu (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter TrackPopupMenu (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter AppendMenuA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SendDlgItemMessageA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetDlgItemTextA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetClassLongA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetDlgItemTextA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreatePopupMenu (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptDeriveKey (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CredEnumerateA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter MoveFileA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter DisconnectNamedPipe (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CallNamedPipeA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WNetOpenEnumA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WNetEnumResourceA (UID: 00000000-00001700) "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" called "GetProcAddress" with a parameter WNetCloseEnum (UID: 00000000-00001700)31:Tbe30,Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "OpenProcessToken"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetNamedSecurityInfoA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "OpenThreadToken"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SelectObject"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetLastError"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "HeapFree"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetStdHandle"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "EnterCriticalSection"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "ReadFile"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "LoadResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "WriteConsoleW"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GlobalFree"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetConsoleCP"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetOEMCP"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "LCMapStringA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "HeapReAlloc"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "HeapAlloc"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "ExitProcess"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "TlsAlloc"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GlobalUnlock"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FlushFileBuffers"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetModuleFileNameA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "RtlUnwind"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "LoadLibraryA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "UpdateResourceA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "DeleteCriticalSection"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetCurrentProcess"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetConsoleMode"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetLocaleInfoA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetCurrentProcessId"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "LCMapStringW"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetHandleCount"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "LockResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "WideCharToMultiByte"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "TlsGetValue"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "MultiByteToWideChar"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "HeapSize"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetCommandLineA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetProcAddress"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "TlsFree"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetCurrentThread"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "EnumResourceTypesA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FindResourceExA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetCPInfo"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetStringTypeA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetFilePointer"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "LeaveCriticalSection"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "WriteFile"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetStartupInfoA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "CloseHandle"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "TerminateProcess"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetACP"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GlobalLock"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetStringTypeW"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetModuleHandleW"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FreeResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetProcessHeap"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "IsDebuggerPresent"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetStdHandle"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SizeofResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "WriteConsoleA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetVersion"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "IsValidCodePage"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "HeapCreate"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "lstrcpyA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "VirtualFree"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "InterlockedDecrement"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "Sleep"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetFileType"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetEndOfFile"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "TlsSetValue"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "CreateFileA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetTickCount"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetCurrentThreadId"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FindResourceA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "VirtualAlloc"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetLastError"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "InterlockedIncrement"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "Shell_NotifyIconA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "InitializeSecurityContextA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "AcquireCredentialsHandleA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "AcceptSecurityContext"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetFocus"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "ReleaseDC"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "PostQuitMessage"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "DefWindowProcA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetWindowTextA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetWindowPos"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "IsWindow"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "AppendMenuA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetWindowRect"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "EnableWindow"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetMenu"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SetWindowPlacement"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "PostMessageA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "MoveWindow"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "EnumChildWindows"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "PeekMessageA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "TranslateMessage"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetWindow"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetDC"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "InsertMenuItemA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetCursorPos"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "DrawTextA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SystemParametersInfoA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "WaitMessage"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "CreatePopupMenu"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetMenu"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetSubMenu"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "DefFrameProcA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "CreateWindowExA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "EnableMenuItem"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "InsertMenuA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetWindowLongA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "CreateMenu"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "SendMessageA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "TranslateAcceleratorA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "TranslateMDISysAccel"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetWindowTextA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "htons"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "inet_addr"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "CoCreateGuid"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "CoInitialize"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "EncodePointer"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "DecodePointer"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FlsFree"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FlsSetValue"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FlsGetValue"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "FlsAlloc"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetProcessWindowStation"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetLastActivePopup"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "GetActiveWindow"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "MessageBoxA"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "UpdateResourceA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceTypesA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.00590000.00000004.mdmp, 00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.00590000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "TranslateMDISysAccel"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "WaitMessage"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "DefFrameProcA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItemA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "AcceptSecurityContext"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandleA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityContextA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp")32:T7e2,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "LockResource" (Indicator: "LockResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "FindResourceExA" (Indicator: "FindResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API "FindResourceExA" (Indicator: "FindResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp")33:Tc6e,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Microsoft Word 97-2003-Dokument" (Path: "HKCU\WOW6432NODE\CLSID\{00020906-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Query file associations" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A07034FD-6CAA-4954-AC3F-97A27216F98A}\INPROCSERVER32") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" touched "Activation Layout Preferences" (Path: "HKCU\WOW6432NODE\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS")34:T505,Observed system executable string:"%WINDIR%\SysWOW64\KERNEL32.DLL" [Source: 00000000-00001700-00000C28-2593994594] Observed system executable string:"%WINDIR%\SysWOW64\SFC.DLL" [Source: 00000000-00001700-00000C28-2594061977] Observed system executable string:"%WINDIR%\SysWOW64\SXS.DLL" [Source: 00000000-00001700-00000C28-2594370490] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00004360-00000C28-2596239883] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00004360-00000C28-2596331312] Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00004360-00000C28-2596629428] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004360-00000C28-2596869535] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004360-00000C28-2628675709] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00004360-00000C28-2629002709] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004360-00000C28-2629174891] Observed system executable string:"%WINDIR%\system32\msi.dll" [Source: 00000000-00004360-00000C60-2784758390]35:T9a8,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000000.229138.00411000.00000002.mdmp, 00000000-00001700.00000001.231058.00403000.00000002.mdmp, 00000000-00001700.00000001.231058.00590000.00000004.mdmp, 00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000001.231058.10001000.00000040.mdmp, 00000000-00001700.00000002.232978.00590000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.10001000.00000040.mdmp") Found reference to API "cdll.LoadLibrary("libc.so.6")" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "self.assertRaises(OSError, cdll.LoadLibrary, "libc.so.9")" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "self.assertRaises(OSError, cdll.LoadLibrary, self.unknowndll)" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "cdll.LoadLibrary(lib)" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "windll.LoadLibrary("kernel32").GetModuleHandleW" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "self.assertRaises(ValueError, windll.LoadLibrary, "kernel32\0")" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "from _ctypes import LoadLibrary, FreeLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp") Found reference to API "handle = LoadLibrary("advapi32")" (Indicator: "LoadLibrary"; Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp, 00000000-00001700.00000002.232978.02C68000.00000004.mdmp")36:T8c5,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}\"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}\"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}\"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPRESSION"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "")37:T112a,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "DATA"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "GENERATION"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "DATA"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "GENERATION"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "DATA"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "GENERATION"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "0E0FE12B-E926-44D2-8CF1-8A62A6D44036"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "139299BB-9394-5058-DD33-9422E5903FC3"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEDHCP"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SETUPOVERRIDE"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "LOGPATH"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "LOGLEVEL"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "LOGMASK"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "LOGMAXFILESIZE"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "382B5E24-181E-417F-A8D6-2155F749E724"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "4E7ADD1A-6945-435A-82B6-612688BA9F57"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "30336ED4-E327-447C-9DE0-51B652C86108"; Value: "") "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A40B455C-253C-4311-AC6D-6E667EDCCEFC"; Value: "")38:Tcd3,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\appdata\local\temp\fyci.cab" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\music\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\links\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\saved games\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\desktop.ini" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\appdata\local\packages\microsoftwindows.client.cbs_cw5n1h2txyewy\localstate\constraintindex\input_{250b58af-8b54-4ff7-8ff4-054a4402d1d1}\settingssynonyms.txt" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\appdata\local\packages\microsoftwindows.client.cbs_cw5n1h2txyewy\localstate\constraintindex\input_{1cb35ea3-3435-42b6-82d4-dd79ac9242e3}\settingssynonyms.txt" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\appdata\local\packages\microsoftwindows.client.cbs_cw5n1h2txyewy\localstate\constraintindex\input_{1cb35ea3-3435-42b6-82d4-dd79ac9242e3}\settingsglobals.txt" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\appdata\local\packages\microsoftwindows.client.cbs_cw5n1h2txyewy\localstate\constraintindex\input_{97ad48e4-9f6b-4a58-a182-b803e4a08805}\settingsconversions.txt" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\appdata\local\packages\microsoftwindows.client.cbs_cw5n1h2txyewy\localstate\constraintindex\input_{1cb35ea3-3435-42b6-82d4-dd79ac9242e3}\appssynonyms.txt" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" reads file "c:\users\%osuser%\appdata\local\packages\microsoftwindows.client.cbs_cw5n1h2txyewy\localstate\constraintindex\input_{250b58af-8b54-4ff7-8ff4-054a4402d1d1}\appsconversions.txt"39:Tbe5,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernel.appcore.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ntmarta.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\IPHLPAPI.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Windows\SysWOW64\IPHLPAPI.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\CRYPTBASE.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Windows\SysWOW64\cryptbase.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\SYSTEM32\dhcpcsvc.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Windows\SysWOW64\dhcpcsvc.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\fyci.cab" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Cabinet.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\SYSTEM32\Cabinet.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Windows\SysWOW64\cabinet.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\fyci.cab" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\DEVRTL.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\SYSTEM32\DEVRTL.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Windows\SysWOW64\devrtl.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\WINDOWS\INF\" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.rtf"3a:Tbae,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\Cabinet.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\DEVRTL.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\PROPSYS.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\profapi.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\CFGMGR32.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\edputil.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\urlmon.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\iertutil.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\srvcli.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\netutils.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\Wldp.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\msi.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\bcrypt.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\srpapi.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\sfc_os.DLL" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\ServicingCommon.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\MPR.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\cscapi.dll" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\vssadmin.exe" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "vssadmin.exe" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" trying to access non-existent file "C:\WindowsCodecs.dll"3b:T1117,"0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\temp\fyci.cab" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\temp\0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.rtf" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "\device\namedpipe\wkssvc" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\demo\spreadsheet.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\win_add2path.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tcl\tk8.6\msgs\pl.msg.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tcl\tk8.6\msgs\it.msg.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tcl\tk8.6\msgs\es.msg.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\umarshal.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\smelly.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tcl\tk8.6\msgs\de.msg.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\pindent.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\pathfix.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\parseentities.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\mkreal.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\lll.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\import_diagnostics.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\highlight.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\get-remote-certificate.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\generate_stdlib_module_names.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\generate_re_casefix.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\find_recursionlimit.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\finddiv.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\dutree.py.kwfmrh" "0210a8f8e729d1b81bf81e39874af98c379f92fcdf802d6d925eb9e65186dfd3.exe" writes file "c:\users\%osuser%\appdata\local\programs\python\python311\tools\scripts\deepfreeze.py.kwfmrh"3c:Tfe9,Found URL "http://qunpack.ahteam.orgarcher" - Source: "00000000-00001700.00000001.231058.00431000.00000002.mdmp") Found URL "https://docs.python.org/3/library/asyncio-dev.html" - Source: "00000000-00001700.00000001.231058.00590000.00000004.mdmp") Found URL "https://www.python.org/sf/1703286" - Source: "00000000-00001700.00000001.231058.02C68000.00000004.mdmp") Found URL "https://static.docs.arm.com/ihi0044/g/aaelf32.pdf" - Source: "00000000-00001700.00000001.231058.02E44000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/fcf1d003bf4f0100c/lib/platform.py" - Source: "00000000-00001700.00000001.231058.02E44000.00000004.mdmp") Found URL "https://bugs.python.org/issue1490384created" - Source: "00000000-00001700.00000001.231058.02EDC000.00000004.mdmp") Found URL "https://www.doxdesk.com/software/py/pyicons.htmlvarious" - Source: "00000000-00001700.00000001.231058.02EDC000.00000004.mdmp") Found URL "https://github.com/python/cpython/pull/17473the" - Source: "00000000-00001700.00000001.231058.02EDC000.00000004.mdmp") Found URL "http://null.python.org," - Source: "00000000-00001700.00000001.231058.02F67000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd'>