24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 49:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Lazy.Generic Sample 0cf19ee17510… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0cf19ee17510…. Malware family: Ser.Lazy.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0cf19ee17510d2a5fc76fd37c7f662ba08000697db304795fc26c936e952cc8e","keywords":["Malicious","Ser.Lazy.Generic","malware analysis","sandbox report","threat intelligence","0cf19ee17510d2a5fc76fd37c7f662ba08000697db304795fc26c936e952cc8e"],"about":{"@type":"SoftwareApplication","name":"chungzx.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"0cf19ee17510d2a5fc76fd37c7f662ba08000697db304795fc26c936e952cc8e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Lazy.Generic","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8e1,Found PE header "MZ" - Source: "00000000-00002696.00000000.67450.005A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002696.00000000.67450.00850000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002696.00000000.67450.00D80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002696.00000000.67450.04280000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002696.00000001.67485.005A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002696.00000001.67485.00850000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002696.00000001.67485.00D80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002696.00000001.67485.04280000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003188.00000000.67777.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003188.00000000.67777.008C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003188.00000000.67777.00B10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003188.00000000.67777.00D80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003188.00000000.67799.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003188.00000000.67799.008C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003188.00000000.67799.00B10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003188.00000000.67799.00D80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003372.00000000.67067.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003372.00000000.67067.013E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003372.00000000.67126.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003372.00000000.67126.013E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003412.00000000.66700.00680000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003412.00000000.66700.006A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003412.00000000.66700.013E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003412.00000000.66700.02060000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003412.00000001.66765.00680000.00000004.mdmp")26:T1539,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"27:T9f6,".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003412) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003412) ".exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003412) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e42b3800000000008504000000260000402b380019040000982f3c00000000009904000034f2270080000000c4f3270095e1a87763401700feffffff000000000200000248a83b000a26002c010000008aa2cf7500000000ff07000048f327000a26002c982f3c0001000000982f3c00020000000c000000d0063c00d0063c00cb063c0000000000ac78d7000000380000000001b4f227000742d769d4f8270095e1a87743401700feffffff435cac775059ac7794000000a0000000ca063c00c8063c009400000058f42700fdfecf75ac0f0000fcf3270000f4270010000000 (UID: 00000000-00003412)28:T108b,".exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100352c343031322c333134342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30323a35322e343036222c52583d302c50583d300030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003412) ".exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6ac7757b99c77f42e1b6df0933a00a0351b6d67b99c7764eb2700b0743a00b2f4ac7777b99c7774eb27000000146d0000146d00000000d0ea2700f0000000f000146d00000000e0ea27005300000074ec2700000000000100000044eb270040f5ac77000000000000000030eb2700 (UID: 00000000-00003412) ".exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c473c74080c42008c473c7400000000080c4200dce12700086dac771881b4770000000090e2270000000000de54f4681ce2270095e1a877ab431700feffffff6b2cad773119ae75021000000000000000000100f0e12700c89fac778c473c740000000000000000 (UID: 00000000-00003412) ".exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003412) ".exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebdc7598541d0000b0fd7f9a5cad7700f0fd7f50c5160044b0fd7f00000000400000003f0000002000000000b0fd7f44c51600c15cad776082b4772000000000b0fd7f9a5cad7700f0fd7f68c516005789ac778083b4771317ae75d8ebdc75 (UID: 00000000-00003372) ".exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003372) "Windows Session Start.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750726f6365737349642c302c302c2c6138380d0a00656c33322e646c6c2c223235323a30333a30342e363731222c52583d302c50583d30003030303030623131643030303030323030303030303533303036353030373230303736303036393030363330303635303032303030353030 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6ac773c6c8577f42eb26980d12600a035b2696c6c857774ec210080be2600b2f4ac775c6c857784ec21000000ab690000ab6900000000e0eb2100f0000000f000ab6900000000f0eb21005300000084ed2100000000000100000054ec210040f5ac77000000000000000040ec2100 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c473c7488bd2d008c473c740000000088bd2d00ece22100086dac771881b47700000000a0e3210000000000de5479682ce3210095e1a877b0910800feffffff6b2cad773119ae7502100000000000000000010000e32100c89fac778c473c740000000000000000 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000030782600d4f85a00145cac77435cac77a0f95a0001000000940124000100000054f85a00935cad774083b477d4a0ac772478fe77a0f95a00010000000100000080c026000000000024f85a0054f85a00c0f85a0095e1a87788840800feffffffd4a0ac771bbead750000097600000000 (UID: 00000000-00002696)29:T548,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "PING.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Windows Session Start.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Windows Session Start.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2a:T4361,".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003412) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter %TEMP%\install.bat (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003372) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003372) "PING.EXE" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00002532) "PING.EXE" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00002532) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002696) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003188) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003188) "Windows Session Start.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003188) "Windows Session Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003188) "Windows Session Start.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00003188) "Windows Session Start.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003188)2b:T13797,".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003412) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003372) ".exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003372) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001992) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001992) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001992) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001992) "PING.EXE" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002532) "PING.EXE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002532) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00002696) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00003188) "Windows Session Start.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003188)2c:T4dc,"select * from PatientTbl" (Source: 6000002-DiagnosisForm~populatecombo, Indicator: "select * from patienttbl") "select * from PatientTbl where PatId=" (Source: 6000003-DiagnosisForm~fecthpatientname, Indicator: "select * from patienttbl where patid=") "select * from DiagnosisTbl" (Source: 6000005-DiagnosisForm~populate, Indicator: "select * from diagnosistbl") "insert into DiagnosisTbl values(" (Source: 6000006-DiagnosisForm~button3_Click, Indicator: "insert into diagnosistbl values(") "delete from DiagnosisTbl where DiagId=" (Source: 6000009-DiagnosisForm~button1_Click, Indicator: "delete from diagnosistbl where diagid=") "select * from DocTorTbl" (Source: 600000f-DoctorForm~populate, Indicator: "select * from doctortbl") "insert into DocTorTbl values(" (Source: 6000014-DoctorForm~button3_Click, Indicator: "insert into doctortbl values(") "delete from DocTorTbl where DocId=" (Source: 6000017-DoctorForm~button1_Click, Indicator: "delete from doctortbl where docid=") "insert into PatientTbl values(" (Source: 600002e-PatientForm~button3_Click, Indicator: "insert into patienttbl values(") "delete from PatientTbl where PatId=" (Source: 6000031-PatientForm~button1_Click, Indicator: "delete from patienttbl where patid=")2d:Tb6b,".exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "Windows Session Start.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135]2e:T502,Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_iexplor") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_iexplor") Found string "" (Indicator: "github.com")30:Ta47,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 276 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 30 Aug 2023 09:19:41 GMT Last-Modified: Wed 30 Aug 2023 09:15:05 GMT Server: ECAcc (saa/8342) X-Cache: HIT Content-Length: 1507 with response body ==>308205DF0A0100A08205D8308205D406092B0601050507300101048205C5308205C130819EA2160414F8B63275C65D2FC64F5EE8A1E6A63A91DA62C5E7180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6228 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 30 Aug 2023 09:20:03 GMT Last-Modified: Wed 30 Aug 2023 07:36:15 GMT Server: ECAcc (saa/8395) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 263 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 30 Aug 2023 09:20:39 GMT Last-Modified: Wed 30 Aug 2023 09:16:18 GMT Server: ECAcc (saa/83B8) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6467 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 30 Aug 2023 09:20:40 GMT Last-Modified: Wed 30 Aug 2023 07:32:53 GMT Server: ECAcc (saa/83C2) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......31:T30bc,".exe" loaded module "KERNEL32" at base 75cb0000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 ".exe" loaded module "SHLWAPI.DLL" at base 76170000 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73080000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 68e50000 ".exe" loaded module "USER32.DLL" at base 76230000 ".exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 ".exe" loaded module "MSCOREE.DLL" at base 6d090000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 67a40000 ".exe" loaded module "OLE32.DLL" at base 76f50000 ".exe" loaded module "CRYPTBASE.DLL" at base 75870000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 ".exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6ce00000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69b60000 ".exe" loaded module "UXTHEME.DLL" at base 743f0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69a30000 ".exe" loaded module "NTDLL.DLL" at base 77a70000 ".exe" loaded module "SHELL32.DLL" at base 76300000 ".exe" loaded module "BCRYPT.DLL" at base 75490000 ".exe" loaded module "CRYPTSP.DLL" at base 75380000 ".exe" loaded module "GDI32.DLL" at base 777b0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75cb0000 ".exe" loaded module "WINDOWSCODECS.DLL" at base 73fa0000 ".exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 770b0000 ".exe" loaded module "RPCRTREMOTE.DLL" at base 75910000 ".exe" loaded module "ADVAPI32.DLL" at base 77bd0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 69cc0000 ".exe" loaded module "VERSION.DLL" at base 74ef0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 ".exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 ".exe" loaded module "PSAPI.DLL" at base 77cb0000 ".exe" loaded module "KERNEL32.DLL" at base 75cb0000 ".exe" loaded module "RPCRT4.DLL" at base 770d0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 66fe0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 66e30000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 65fc0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 657a0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 65020000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 69a10000 ".exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 770b0000 ".exe" loaded module "PROFAPI.DLL" at base 75990000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75110000 ".exe" loaded module "IMM32.DLL" at base 77350000 ".exe" loaded module "COMCTL32.DLL" at base 6d140000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 64e30000 ".exe" loaded module "GDIPLUS.DLL" at base 74250000 ".exe" loaded module "AMSI.DLL" at base 0 ".exe" loaded module "NTDLL" at base 77a70000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75820000 ".exe" loaded module "PROPSYS.DLL" at base 746a0000 ".exe" loaded module "COMCTL32.DLL" at base 747c0000 ".exe" loaded module "OLEAUT32.DLL" at base 77180000 ".exe" loaded module "CLBCATQ.DLL" at base 772c0000 ".exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 746a0000 ".exe" loaded module "NTMARTA.DLL" at base 74e90000 ".exe" loaded module "APPHELP.DLL" at base 75820000 ".exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f4d0000 ".exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76300000 ".exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 775b0000 ".exe" loaded module "SECUR32.DLL" at base 756b0000 ".exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 759c0000 ".exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 72190000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69df0000 ".exe" loaded module "SETUPAPI.DLL" at base 778d0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75cb0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75820000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75340000 "PING.EXE" loaded module "WSHTCPIP" at base 74df0000 "PING.EXE" loaded module "WSHIP6.DLL" at base 75330000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 70fc0000 "Windows Session Start.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73080000 "Windows Session Start.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Windows Session Start.exe" loaded module "KERNEL32" at base 75cb0000 "Windows Session Start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Windows Session Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 69d10000 "Windows Session Start.exe" loaded module "SHLWAPI.DLL" at base 76170000 "Windows Session Start.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "Windows Session Start.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "Windows Session Start.exe" loaded module "VERSION.DLL" at base 74ef0000 "Windows Session Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 686a0000 "Windows Session Start.exe" loaded module "USER32.DLL" at base 76230000 "Windows Session Start.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "Windows Session Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Windows Session Start.exe" loaded module "MSCOREE.DLL" at base 6d180000 "Windows Session Start.exe" loaded module "PSAPI.DLL" at base 77cb0000 "Windows Session Start.exe" loaded module "KERNEL32.DLL" at base 75cb0000 "Windows Session Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 67290000 "Windows Session Start.exe" loaded module "RPCRT4.DLL" at base 770d0000 "Windows Session Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Windows Session Start.exe" loaded module "OLE32.DLL" at base 76f50000 "Windows Session Start.exe" loaded module "CRYPTBASE.DLL" at base 75870000 "Windows Session Start.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 "Windows Session Start.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72a00000 "Windows Session Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 66830000 "Windows Session Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69450000 "Windows Session Start.exe" loaded module "ADVAPI32.DLL" at base 77bd0000 "Windows Session Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "Windows Session Start.exe" loaded module "UXTHEME.DLL" at base 743f0000 "Windows Session Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 651a0000 "Windows Session Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69340000 "Windows Session Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 64a20000 "Windows Session Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d0c0000 "Windows Session Start.exe" loaded module "NTDLL.DLL" at base 77a70000 "Windows Session Start.exe" loaded module "SHELL32.DLL" at base 76300000 "Windows Session Start.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 770b0000 "Windows Session Start.exe" loaded module "PROFAPI.DLL" at base 75990000 "Windows Session Start.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Windows Session Start.exe" loaded module "BCRYPT.DLL" at base 75490000 "Windows Session Start.exe" loaded module "CRYPTSP.DLL" at base 75380000 "Windows Session Start.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75110000 "Windows Session Start.exe" loaded module "IMM32.DLL" at base 77350000 "Windows Session Start.exe" loaded module "COMCTL32.DLL" at base 69ab0000 "Windows Session Start.exe" loaded module "GDI32.DLL" at base 777b0000 "Windows Session Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 69150000 "Windows Session Start.exe" loaded module "GDIPLUS.DLL" at base 74250000 "Windows Session Start.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 74250000 "Windows Session Start.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75cb0000 "Windows Session Start.exe" loaded module "AMSI.DLL" at base 0 "Windows Session Start.exe" loaded module "WINDOWSCODECS.DLL" at base 73fa0000 "Windows Session Start.exe" loaded module "NTDLL" at base 77a70000 "Windows Session Start.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 770b0000 "Windows Session Start.exe" loaded module "RPCRTREMOTE.DLL" at base 75910000 "Windows Session Start.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77350000 "Windows Session Start.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d0e0000 "Windows Session Start.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "Windows Session Start.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 659c0000 "Windows Session Start.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7582000032:T4dc,"select * from PatientTbl" (Source: 6000002-DiagnosisForm~populatecombo, Indicator: "select * from patienttbl") "select * from PatientTbl where PatId=" (Source: 6000003-DiagnosisForm~fecthpatientname, Indicator: "select * from patienttbl where patid=") "select * from DiagnosisTbl" (Source: 6000005-DiagnosisForm~populate, Indicator: "select * from diagnosistbl") "insert into DiagnosisTbl values(" (Source: 6000006-DiagnosisForm~button3_Click, Indicator: "insert into diagnosistbl values(") "delete from DiagnosisTbl where DiagId=" (Source: 6000009-DiagnosisForm~button1_Click, Indicator: "delete from diagnosistbl where diagid=") "select * from DocTorTbl" (Source: 600000f-DoctorForm~populate, Indicator: "select * from doctortbl") "insert into DocTorTbl values(" (Source: 6000014-DoctorForm~button3_Click, Indicator: "insert into doctortbl values(") "delete from DocTorTbl where DocId=" (Source: 6000017-DoctorForm~button1_Click, Indicator: "delete from doctortbl where docid=") "insert into PatientTbl values(" (Source: 600002e-PatientForm~button3_Click, Indicator: "insert into patienttbl values(") "delete from PatientTbl where PatId=" (Source: 6000031-PatientForm~button1_Click, Indicator: "delete from patienttbl where patid=")33:T920,"chungzx.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Windows Session Start.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"34:T592,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "PING.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "PING.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Windows Session Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Windows Session Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Windows Session Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Windows Session Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Windows Session Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")35:T64d,Found string "" (Indicator: "text/javascript"; File: "M0BV128Q.htm") Found string "" (Indicator: "text/javascript"; File: "M0BV128Q.htm") Found string "" (Indicator: "text/javascript"; File: "M0BV128Q.htm") Found string "" (Indicator: "text/javascript"; File: "M0BV128Q.htm") Found string "