26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Convagent Sample 481ecd41bef2… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 481ecd41bef2…. Malware family: Trojan.Convagent. Threat score 76/100. 4/28 AV engines flagged this file. 9 malicious and 33 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","keywords":["Malicious","Trojan.Convagent","malware analysis","sandbox report","threat intelligence","481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214"],"about":{"@type":"SoftwareApplication","name":"ScreenWings.exe","applicationCategory":["peexe","executable"],"identifier":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","additionalType":"Malicious sample"},"threatScore":76,"malwareFamily":"Trojan.Convagent","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":33},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T44f,The input sample is signed with a certificate issued by "C=DE, PostalCode=52525, L=Waldfeucht, STREET=Berlderath 17, O=Hendrik Schiffer, CN=Hendrik Schiffer" (SHA1: A6:9C:6B:30:F6:5D:C9:57:7E:D4:77:13:B3:96:61:5E:A8:B8:35:4A: (1.2.840.113549.1.1.11); see report for more information) The input sample is signed with a certificate issued by "C=GB, S=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Code Signing CA" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66: (1.2.840.113549.1.1.12); see report for more information) The input sample is signed with a certificate issued by "C=US, S=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority" (SHA1: EA:B0:40:68:9A:0D:80:5B:5D:6F:D6:54:FC:16:8C:FF:00:B7:8B:E3: (1.2.840.113549.1.1.12); see report for more information) The input sample is signed with a certificate issued by "C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root" (SHA1: 02:FA:F3:E2:91:43:54:68:60:78:57:69:4D:F5:E4:5B:68:85:18:68: (sha1RSA(RSA)); see report for more information)28:T5c5,"ScreenWings.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "ScreenWings.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll.aux" "ScreenWings.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll.aux" "ScreenWings.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "ScreenWings.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "ScreenWings.exe" touched file "C:\Windows\Fonts\verdana.ttf" "ScreenWings.exe" touched file "C:\Windows\Fonts\tahoma.ttf" "ScreenWings.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "ScreenWings.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "ScreenWings.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "ScreenWings.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "ScreenWings.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "ScreenWings.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "ScreenWings.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "ScreenWings.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll"29:T434,Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "ULQE-n.PN" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl0t" Pattern match: "crt.usertrust.com/UTNAddTrustObject_CA.crt0%" Pattern match: "https://sectigo.com/CPS0B" Pattern match: "crl.sectigo.com/COMODOTimeStampingCA_2.crl0r" Pattern match: "crt.sectigo.com/COMODOTimeStampingCA_2.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "https://sectigo.com/CPS0C" Pattern match: "crl.sectigo.com/SectigoRSACodeSigningCA.crl0s" Pattern match: "crt.sectigo.com/SectigoRSACodeSigningCA.crt0#" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "https://sectigo.com/CPS0D" Pattern match: "crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" Pattern match: "crt.sectigo.com/SectigoRSATimeStampingCA.crt0#"2a:T409,"FreeLibrary@KERNEL32.DLL" in "ScreenWings.exe" "FreeLibrary@KERNELBASE.DLL" in "ScreenWings.exe" "GetModuleHandleExW@KERNELBASE.DLL" in "ScreenWings.exe" "GetProcAddress@KERNEL32.DLL" in "ScreenWings.exe" "CloseHandle@KERNEL32.DLL" in "ScreenWings.exe" "GetProcAddress@KERNELBASE.DLL" in "ScreenWings.exe" "SearchPathW@KERNEL32.DLL" in "ScreenWings.exe" "SearchPathW@KERNELBASE.DLL" in "ScreenWings.exe" "DuplicateHandle@KERNELBASE.DLL" in "ScreenWings.exe" "OpenFileMappingW@KERNEL32.DLL" in "ScreenWings.exe" "OpenFileMappingA@KERNEL32.DLL" in "ScreenWings.exe" "GetModuleHandleA@KERNELBASE.DLL" in "ScreenWings.exe" "_lopen@KERNEL32.DLL" in "ScreenWings.exe" "GetModuleHandleExW@KERNEL32.DLL" in "ScreenWings.exe" "CryptVerifySignatureA@ADVAPI32.DLL" in "ScreenWings.exe" "_llseek@KERNEL32.DLL" in "ScreenWings.exe" "SearchPathA@KERNEL32.DLL" in "ScreenWings.exe" "GetModuleHandleA@KERNEL32.DLL" in "ScreenWings.exe" "GetFileType@KERNELBASE.DLL" in "ScreenWings.exe" "_lclose@KERNEL32.DLL" in "ScreenWings.exe"2b:T8ac,"ScreenWings.exe" wrote bytes "e9fd961c8a" to virtual address "0x76EE3468" ("FreeLibrary@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9e79cd48b" to virtual address "0x75362E7E" ("FreeLibrary@KERNELBASE.DLL") "ScreenWings.exe" wrote bytes "e99d78e88b" to virtual address "0x75361EFA" ("GetModuleHandleExW@KERNELBASE.DLL") "ScreenWings.exe" wrote bytes "e9b93c2f8a" to virtual address "0x76EE1222" ("GetProcAddress@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e94357308a" to virtual address "0x76EE13E0" ("CloseHandle@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9a32fe78b" to virtual address "0x75361F38" ("GetProcAddress@KERNELBASE.DLL") "ScreenWings.exe" wrote bytes "e97576338a" to virtual address "0x76EFCD60" ("SearchPathW@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9b0e4ec8b" to virtual address "0x75365F25" ("SearchPathW@KERNELBASE.DLL") "ScreenWings.exe" wrote bytes "e93ad8e58b" to virtual address "0x7535C5A0" ("DuplicateHandle@KERNELBASE.DLL") "ScreenWings.exe" wrote bytes "e97ae61b8a" to virtual address "0x76EE173B" ("OpenFileMappingW@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9c9b8328a" to virtual address "0x76EE4BBB" ("OpenFileMappingA@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9d080e28b" to virtual address "0x75362FE1" ("GetModuleHandleA@KERNELBASE.DLL") "ScreenWings.exe" wrote bytes "e97fba178a" to virtual address "0x76F5FD95" ("_lopen@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9884d308a" to virtual address "0x76EE4A0F" ("GetModuleHandleExW@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9469bf889" to virtual address "0x77253584" ("CryptVerifySignatureA@ADVAPI32.DLL") "ScreenWings.exe" wrote bytes "711149027a3b4802ab8b02007f950200fc8c0200729602006cc805001ecd45027d264502" to virtual address "0x754607E4" (part of module "USER32.DLL") "ScreenWings.exe" wrote bytes "e925c31e8a" to virtual address "0x76EE588C" ("_llseek@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9bc5d228a" to virtual address "0x76EFA14C" ("SearchPathA@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e96c9e2a8a" to virtual address "0x76EE1245" ("GetModuleHandleA@KERNEL32.DLL") "ScreenWings.exe" wrote bytes "e9b46cf28b" to virtual address "0x7535DC9E" ("GetFileType@KERNELBASE.DLL")2c:T203b,Found reference to "HMACSHA512" (Indicator: "HMAC"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to "HMACSHA512" (Indicator: "SHA512"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp")2d:T27ae,"ScreenWings.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000061281b39a3838d7110007b00687d7a75b8ef7b0040b18d71c5b8ef48feffffffd4ee7b0002728c7178ee7b000000417770ef7b001b728c71e0df687708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000000ef7b00000000000800000000000000000000000000000000000000000000000000000059281b390000000040ef7b006992bb76ffffffff3400000000ef7b0008000000000000000000417770ef7b002794bb7608ef7b000b0000000000000058ef7b00 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000048ef7b00ecee7b00226e317700009403000000002d6e3177f03a88b12d000000ecb72b7470ef7b000000ae00c0e67f0348897f030e00000080000000b0ee7b000000ae0034ef7b0070c83277e4a5c4c6feffffff2d000000d0cc3a742700000004ef7b00856a33771c23387744ef7b00f85f337708000000bb693277b2693277583b88b12d000000ecb72b7427000000d0cc3a7418ef7b002d000000d0cc3a742700000048ef7b00856a33771c23387790ef7b007e8a3974ee8c3974738a397491c0e9f52d000000ecb72b7427000000d0cc3a742c119403c010940391c0e9f558ef7b00fc52777444f07b00e084397439dee781feffffff738a3974 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000100000000d8db7b01083394030833940302000000543744722800000008dc7b001033940330369403a3017c771a00010cfeffffff00009403600294030000000050000005000000002800000002000000600294032800000028000000280000002800000029ab7e77ecdc7b00f8dc7b00506a7f7702d2a17bfeffffff80dc7b00b7167c771c00000028000000a80294036cdc7b000407437200009403000000002800000000000000000000000500000003000000000094031c0000000000000090029403a0dc7b00ee137c771c000000ee137c7700000000000000001c000000ffffffffc0dc7b005072317700009403000000001c00000004074372 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007b77608e370a608e370a00000000f03c94035094360a7883370a310000006094360a46002a0050f57b77e876360ae876360a00000000b80888b1a07694039867360a2c000000b07694030d00260050f57b77283f370a283f370a00000000608e370a6093360ad83a370a210000007093360a040021000008700564000000f00888b1e876360ae876360a00000000feffffff8470317718dd7b0065703177000094030000000084703177040988b1283f370a283f370a00000000e32e3f72e876360ab5ce3b72803331fae0dc7b00176f3c7274dd7b0070c832773ca6c4c6feffffff847031770a8e3e72283f370af08d3e7240dd7b00a7ce3b7201000000 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007b777091370a7091370a00000000000000005094360a7883370a3f00000050f57b77e075360ae075360a0000000084703177a07694039867360a29000000b07694030d002800a80b70056400000050f57b77283f370a283f370a000000007091370a6093360ad83a370a210000007093360a040021000008700564000000e075360ae075360a00000000feffffff8470317714dd7b0065703177000094030000000084703177080988b1283f370a283f370a00000000e32e3f72e075360ab5ce3b727c3231fadcdc7b00176f3c7274dd7b0070c832773ca6c4c6feffffff847031770a8e3e72283f370af08d3e723cdd7b00a7ce3b7201000000504b3c72 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000009b71187d9b7100000000d0a94b770000447790114577f856810348607f03f8de8603c0df7b00feffffff68e27b00506a7f77dad3a17bfeffffff80e07b00eaa97b77f856810300000000f8de8603a11400000a000b00b2979b715c769b7168769b71f8de860360488603140000000000000000000000f8568103a8e07b00cc2d8077f8de86030000000004df860300000000f800947100000000cc0d24385ce87e7768407d77cc040000f8de86030000000077407d77000000000100000024578103180000000000000018e17b00400800000000000000000000f8de860300009471feffffff1c578103cc040000000000000000000023457d7708e17b00 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000001001fb8c7c770100000008001400fc86ee730cc97b000000000000000000ee137c7716fe100109000000386a810309000000fc86ee7380c87b0050053373bd1b0000c0003d087661010124050000c0003d080000000000824a0837067b7748f046080000000000000000c0804a080000000050f04608bd1b00007f07000038a537017f070000f8413d08f8413d0838a5370100824a08c8c69d08a0cb7b00506a7f7762d2a17bfefffffff8c87b000dfa7b770000000000824a08bbb000000000000000824a0876610100bbc00000bbb000000000000082ee5d0c10c97b00dab9b97600002a7304c97b00000000000cc97b000000000016fe10010020cd00 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000d0b97b0038cf7c7734247f033cba7b0001000000e8237f0334247f03e8237f03040000000400000000e0c576001000003cba7b0001000000e8237f03cd977c779c977c77069a5d0cb50fbc76e8237f0300007c7700000000bc284a760000000080eec2760100000000000000f8e2c5760000000004000000000000004840c476f8e2c57640ba7b0080e8ad75a006800380e8ad753cba7b000000000080e8ad7500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004e799f0864799f08 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008ef1a508a6f1a508 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000aeba8703c2ba8703 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005eefa50876efa508 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005e7b9f08747b9f08 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c6ffa508deffa508 (UID: 00000000-00007960) "ScreenWings.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004efaa50866faa508 (UID: 00000000-00007960)2e:Ta5b,"ScreenWings.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000017000017f3320000e81b8103b0e4800310000000c0877f030100000003000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d00 (UID: 00000000-00007960) "ScreenWings.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00001676) "ScreenWings.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00004332) "ScreenWings.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00002184) "ScreenWings.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00007636) "ScreenWings.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00003720) "ScreenWings.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00004112)2f:T12d7,Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API "FindWindowEx" (Indicator: "FindWindow"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API "83825971640,1692,107,,GetActiveWindow,user32.dll,"00:24:26.171",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83926063022,1692,107,,GetActiveWindow,user32.dll,"00:24:26.203",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83908840950,1692,107,,GetActiveWindow,user32.dll,"00:24:26.203",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83946861958,1692,107,,GetActiveWindow,user32.dll,"00:24:26.218",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83823030168,1692,107,,GetActiveWindow,user32.dll,"00:24:26.171",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83802847194,1692,107,,GetActiveWindow,user32.dll,"00:24:26.156",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83682639564,1692,107,,GetActiveWindow,user32.dll,"00:24:26.109",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83937062160,1692,107,,GetActiveWindow,user32.dll,"00:24:26.218",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83895579780,1692,107,,GetActiveWindow,user32.dll,"00:24:26.203",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83862026742,1692,107,,GetActiveWindow,user32.dll,"00:24:26.187",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83964754326,1692,107,,GetActiveWindow,user32.dll,"00:24:26.218",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83937171034,1692,107,,GetActiveWindow,user32.dll,"00:24:26.218",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83964830036,1692,107,,GetActiveWindow,user32.dll,"00:24:26.218",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "83789729114,1692,107,,GetActiveWindow,user32.dll,"00:24:26.156",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000001.93838.08549000.00000004.mdmp") Found reference to API "155548819950,1692,107,,GetActiveWindow,user32.dll,"00:24:56.046",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found reference to API "155891104318,1692,107,,GetActiveWindow,user32.dll,"00:24:56.203",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found reference to API "156015567562,1692,107,,GetActiveWindow,user32.dll,"00:24:56.250",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found reference to API "155905886220,1692,107,,GetActiveWindow,user32.dll,"00:24:56.203",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found reference to API "155343874796,1692,107,,GetActiveWindow,user32.dll,"00:24:55.968",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found reference to API "155900596772,1692,107,,GetActiveWindow,user32.dll,"00:24:56.203",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found reference to API "154841539940,1692,107,,GetActiveWindow,user32.dll,"00:24:55.765",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found reference to API "155905986544,1692,107,,GetActiveWindow,user32.dll,"00:24:56.203",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found reference to API "155649436200,1692,107,,GetActiveWindow,user32.dll,"00:24:56.093",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001676.00000002.95759.08549000.00000004.mdmp")30:T1334,"ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00007960-00000C15-431525421 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007960-00000C15-431562618 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00007960-00000C15-431742675 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00007960-00000C15-432260060 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00007960-00000C15-432288399 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00007960-00000C15-433472081 "ScreenWings.exe" queries volume information of "C:\Windows\Fonts\verdana.ttf" at 00000000-00007960-00000C15-434335214 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll" at 00000000-00007960-00000C15-436289825 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00001676-00000C15-451125761 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00001676-00000C15-451157838 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00001676-00000C15-451252677 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00001676-00000C15-451984987 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00001676-00000C15-452031491 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00001676-00000C15-454062705 "ScreenWings.exe" queries volume information of "C:\Windows\Fonts\verdana.ttf" at 00000000-00001676-00000C15-454995901 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll" at 00000000-00001676-00000C15-456924241 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00004332-00000C15-466162033 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00004332-00000C15-466182122 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00004332-00000C15-466374788 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00004332-00000C15-466797391 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00004332-00000C15-466854350 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00004332-00000C15-468991358 "ScreenWings.exe" queries volume information of "C:\Windows\Fonts\verdana.ttf" at 00000000-00004332-00000C15-470138460 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll" at 00000000-00004332-00000C15-471465187 "ScreenWings.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00002184-00000C15-48133729431:T1b2c,"ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007960) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001676) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004332) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002184) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007636) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003720) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004112) "ScreenWings.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004112)32:T9840,"ScreenWings.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007960) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001676) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004332) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002184) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007636) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003720) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004112) "ScreenWings.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004112)33:T2752,Found reference to API (Indicator: "GetModuleHandleA"; File: "ScreenWings.exe") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "SetWindowLongPtr"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "FindWindowEx"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "NtContinue"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "SetWinEventHook"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp")34:Td9c,"th;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Local\Prog\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00001676.00000001.93838.00790000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001676.00000001.93838.00790000.00000004.mdmp 00000000-00001676.00000002.95759.00790000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001676.00000001.93838.00790000.00000004.mdmp 00000000-00001676.00000002.95759.00790000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001676.00000001.93838.00790000.00000004.mdmp 00000000-00001676.00000002.95759.00790000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001676.00000001.93838.00790000.00000004.mdmp 00000000-00001676.00000002.95759.00790000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001676.00000001.93838.00790000.00000004.mdmp 00000000-00001676.00000002.95759.00790000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001676.00000001.93838.08549000.00000004.mdmp 00000000-00001676.00000002.95759.08549000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001676.00000001.93838.08549000.00000004.mdmp 00000000-00001676.00000002.95759.08549000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001676.00000002.95759.723A1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00001676.00000002.95759.723A1000.00000020.mdmp "HKLM\" in Source: 00000000-00001676.00000002.95759.723A1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001676.00000002.95759.723A1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001676.00000002.95759.723A1000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004112.00000001.97269.00800000.00000004.mdmp 00000000-00004112.00000002.99190.00800000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004112.00000001.97269.00800000.00000004.mdmp 00000000-00004112.00000002.99190.00800000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004112.00000001.97269.05620000.00000004.mdmp 00000000-00004112.00000002.99190.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004112.00000001.97269.05620000.00000004.mdmp 00000000-00004112.00000002.99190.05620000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00004112.00000001.97269.05620000.00000004.mdmp 00000000-00004112.00000002.99190.05620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00004112.00000001.97269.05620000.00000004.mdmp 00000000-00004112.00000002.99190.05620000.00000004.mdmp35:T521,"ScreenWings.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "ScreenWings.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "ScreenWings.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "ScreenWings.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "ScreenWings.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "ScreenWings.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "ScreenWings.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "ScreenWings.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:ffffffffc0000135]36:T1ad9,"ScreenWings.exe" loaded module "KERNEL32" at base 75fa0000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76ab0000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76ab0000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76ab0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76240000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76ab0000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76ab0000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76ab0000 "ScreenWings.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72f00000 "ScreenWings.exe" loaded module "USER32.DLL" at base 77440000 "ScreenWings.exe" loaded module "ADVAPI32.DLL" at base 741c0000 "ScreenWings.exe" loaded module "NTDLL.DLL" at base 77780000 "ScreenWings.exe" loaded module "SHELL32.DLL" at base 74290000 "ScreenWings.exe" loaded module "SHLWAPI.DLL" at base 75630000 "ScreenWings.exe" loaded module "MSCOREE.DLL" at base 71850000 "ScreenWings.exe" loaded module "KERNEL32.DLL" at base 75fa0000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72dd0000 "ScreenWings.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76a80000 "ScreenWings.exe" loaded module "VERSION.DLL" at base 73ec0000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72620000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76ab0000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76400000 "ScreenWings.exe" loaded module "PSAPI.DLL" at base 75f90000 "ScreenWings.exe" loaded module "RPCRT4.DLL" at base 75900000 "ScreenWings.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70440000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "ScreenWings.exe" loaded module "OLE32.DLL" at base 760d0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76400000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76ab0000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 724c0000 "ScreenWings.exe" loaded module "WLDP.DLL" at base 724a0000 "ScreenWings.exe" loaded module "AMSI.DLL" at base 72490000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73ec0000 "ScreenWings.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72440000 "ScreenWings.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 723a0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75fa0000 "ScreenWings.exe" loaded module "USERENV.DLL" at base 72460000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 741c0000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "ScreenWings.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f9e0000 "ScreenWings.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 71b10000 "ScreenWings.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71a00000 "ScreenWings.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f260000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "ScreenWings.exe" loaded module "BCRYPT.DLL" at base 73050000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 719d0000 "ScreenWings.exe" loaded module "IMM32.DLL" at base 76240000 "ScreenWings.exe" loaded module "COMCTL32.DLL" at base 71940000 "ScreenWings.exe" loaded module "GDI32.DLL" at base 77410000 "ScreenWings.exe" loaded module "GDIPLUS.DLL" at base 73ee0000 "ScreenWings.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73ee0000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76ab0000 "ScreenWings.exe" loaded module "DWMAPI.DLL" at base 72e80000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "ScreenWings.exe" loaded module "OLEAUT32.DLL" at base 76270000 "ScreenWings.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 77440000 "ScreenWings.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 77440000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76400000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 767a0000 "ScreenWings.exe" loaded module "WINDOWSCODECS.DLL" at base 732a0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 760d0000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 736f0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6eab0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74290000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75fa0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73a90000 "ScreenWings.exe" loaded module "MSISO.DLL" at base 6ea50000 "ScreenWings.exe" loaded module "SSPICLI.DLL" at base 741a0000 "ScreenWings.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76ab0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 759c0000 "ScreenWings.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72e80000 "ScreenWings.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\COMCTL32.DLL" at base 037:T45a,"ScreenWings.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "ScreenWings.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "ScreenWings.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "ScreenWings.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "ScreenWings.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "ScreenWings.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "ScreenWings.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "ScreenWings.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")38:T460,"ScreenWings.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "ScreenWings.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: ""; Value: "") "ScreenWings.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "ScreenWings.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "ScreenWings.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "ScreenWings.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ScreenWings.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "ScreenWings.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ScreenWings.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")39:T9ed,"ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "DBGJITDEBUGLAUNCHSETTING"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "DBGMANAGEDDEBUGGER"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "SCREENWINGS"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "ScreenWings.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3a:T953,"ScreenWings.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "ScreenWings.exe" trying to access non-existent file "C:\MSCOREE.DLL" "ScreenWings.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ScreenWings.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "ScreenWings.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "ScreenWings.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "ScreenWings.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\X86\SLC.DLL"3b:T75f,"ScreenWings.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "ScreenWings.exe" trying to access non-existent file "C:\SCREENWINGS.EXE.CONFIG" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "ScreenWings.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SCREENWINGS.EXE.LOG" "ScreenWings.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SCREENWINGS" "ScreenWings.exe" trying to access non-existent file "C:\SCREENWINGS.INI" "ScreenWings.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "ScreenWings.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.V9921E851#" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\MICROSOFT.VISUALBASIC.INI" "ScreenWings.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "ScreenWings.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "ScreenWings.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "ScreenWings.exe" trying to access non-existent file "C:\SCREENWINGS.EXE.LOCAL" "ScreenWings.exe" trying to access non-existent file "C:\ScreenWings.exe.Local\" "ScreenWings.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\ACCESSIBILITY"3c:T3c54,Found URL "http://artcoastdesign.comdmitry@thecourage.ru2'0&%*+$9:618;(=-,.)" - Source: "00000000-00007960.00000002.95036.72441000.00000020.mdmp")3d:T4be,Found string "+ncalrpc:[OLE32357BB9DEF078402343BCE3F437]" (Indicator: "ncalrpc"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string "+ncalrpc:[OLEA386A0E895E36E53656308DC0A60]" (Indicator: "ncalrpc"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string "B+ncalrpc:[OLEA386A0E895E36E53656308DC0A60]" (Indicator: "ncalrpc"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000001.93838.08549000.00000004.mdmp, 00000000-00001676.00000002.95759.08549000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found string "+ncalrpc:[OLE6CDE8116E5486C783780084F0C96]" (Indicator: "ncalrpc"; Source: "00000000-00004112.00000001.97269.00800000.00000004.mdmp, 00000000-00004112.00000002.99190.00800000.00000004.mdmp")3e:T9b4,"ScreenWings.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007960) "ScreenWings.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007960)3f:T1916,Found string "osoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001676.00000002.95759.0C180000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001676.00000002.95759.0C180000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001676.00000002.95759.0C180000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001676.00000002.95759.0C180000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004112.00000001.97269.00800000.00000004.mdmp, 00000000-00004112.00000002.99190.00800000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004112.00000001.97269.00800000.00000004.mdmp, 00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.00800000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp")40:T414,Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001676.00000001.93838.00C42000.00000040.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001676.00000002.95759.723A1000.00000020.mdmp")41:T478,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp")42:T5ee,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001676.00000000.91917.00790000.00000004.mdmp, 00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002184.00000000.94178.00880000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003720.00000000.95315.009C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004112.00000000.95351.00800000.00000004.mdmp, 00000000-00004112.00000001.97269.00800000.00000004.mdmp, 00000000-00004112.00000002.99190.00800000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004112.00000001.97269.00800000.00000004.mdmp, 00000000-00004112.00000002.99190.00800000.00000004.mdmp")43:T604,"ScreenWings.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\SCREENWINGS.EXE"; Value: "AA85C958263ADB0100000000000000000000000002000000") "ScreenWings.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\SCREENWINGS.EXE"; Value: "34A06B0F273ADB0100000000000000000000000002000000") "ScreenWings.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\SCREENWINGS.EXE"; Value: "D74965D1273ADB0100000000000000000000000002000000") "ScreenWings.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\SCREENWINGS.EXE"; Value: "173575D4273ADB0100000000000000000000000002000000") "ScreenWings.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\SCREENWINGS.EXE"; Value: "C8BACCB6283ADB0100000000000000000000000002000000") "ScreenWings.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\SCREENWINGS.EXE"; Value: "F44746BD283ADB0100000000000000000000000002000000")44:Ta26,"ScreenWings.exe" queried SystemProcessInformation at 00000000-00007960-00000C13-425955180 [PID: 7960] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00007960-00000C13-425964621 [PID: 7960] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00007960-00000C13-426225338 [PID: 7960] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00007960-00000C13-426234343 [PID: 7960] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00007960-00000C13-426678221 [PID: 7960] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00007960-00000C13-426688065 [PID: 7960] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00001676-00000C13-437315434 [PID: 1676] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00001676-00000C13-437323725 [PID: 1676] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00001676-00000C13-437712985 [PID: 1676] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00001676-00000C13-437721318 [PID: 1676] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00001676-00000C13-438259465 [PID: 1676] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00001676-00000C13-438276551 [PID: 1676] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00004332-00000C13-458070870 [PID: 4332] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00004332-00000C13-458078763 [PID: 4332] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00004332-00000C13-458617742 [PID: 4332] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00004332-00000C13-458636731 [PID: 4332] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00004332-00000C13-459129730 [PID: 4332] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00004332-00000C13-459137684 [PID: 4332] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00002184-00000C13-472740373 [PID: 2184] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00002184-00000C13-472784514 [PID: 2184] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00002184-00000C13-473127706 [PID: 2184] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00002184-00000C13-473172216 [PID: 2184] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00002184-00000C13-473818917 [PID: 2184] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00002184-00000C13-473860594 [PID: 2184] "ScreenWings.exe" queried SystemProcessInformation at 00000000-00007636-00000C13-473159914 [PID: 7636]45:T26cc,"vboxvideo.inf" (Indicator: "vbox") "2021-09-30 08:02:46, Error DISM DISM Driver Manager: PID=728 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_b5a89e0985fba0dc\vboxguest.inf' - CDriverPackage::OpenDmiDr" (Indicator: "vbox") "2021-09-30 08:02:46, Error DISM DISM Driver Manager: PID=728 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_b5a89e0985fba0dc\vboxguest.inf' - CDriverPackage::OpenDmiDr" (Indicator: "vboxguest") "2017-12-06 22:51:39, Info DISM API: PID=3692 TID=3748 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_x86_neutral_194f6963f2c52026\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-06 22:51:39, Info DISM DISM Driver Manager: PID=4052 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2017-12-06 22:51:39, Info DISM DISM Driver Manager: PID=4052 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2017-12-06 22:51:39, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\VBoxGuest.cat]" (Indicator: "vbox") "2017-12-06 22:51:39, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\VBoxGuest.cat]" (Indicator: "vboxguest") "2017-12-06 22:51:39, Info DISM DISM Driver Manager: PID=4052 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2017-12-06 22:51:39, Info DISM DISM Driver Manager: PID=4052 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2017-12-06 22:51:39, Info DISM API: PID=3692 TID=3748 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-06 22:51:39, Info DISM API: PID=3692 TID=3748 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-12-21 18:26:02, Info DISM API: PID=2904 TID=1308 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_x86_neutral_fa6902d06b336357\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-12-21 18:26:02, Info DISM DISM Driver Manager: PID=2784 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-12-21 18:26:02, Info DISM DISM Driver Manager: PID=2784 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-12-21 18:26:02, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\VBoxGuest.cat]" (Indicator: "vbox") "2018-12-21 18:26:02, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-12-21 18:26:02, Info DISM DISM Driver Manager: PID=2784 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-12-21 18:26:02, Info DISM DISM Driver Manager: PID=2784 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-12-21 18:26:02, Info DISM API: PID=2904 TID=1308 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-12-21 18:26:02, Info DISM API: PID=2904 TID=1308 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-12-28 13:06:08, Info DISM API: PID=1552 TID=2416 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_x86_neutral_fa6902d06b336357\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-12-28 13:06:08, Info DISM DISM Driver Manager: PID=3368 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-12-28 13:06:08, Info DISM DISM Driver Manager: PID=3368 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-12-28 13:06:08, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\VBoxGuest.cat]" (Indicator: "vbox") "2018-12-28 13:06:08, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-12-28 13:06:08, Info DISM DISM Driver Manager: PID=3368 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-12-28 13:06:08, Info DISM DISM Driver Manager: PID=3368 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-12-28 13:06:08, Info DISM API: PID=1552 TID=2416 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-12-28 13:06:08, Info DISM API: PID=1552 TID=2416 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-03-20 21:46:18, Info DISM API: PID=1644 TID=2120 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_x86_neutral_ecf53092b172f4a2\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-03-20 21:46:18, Info DISM DISM Driver Manager: PID=3316 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-03-20 21:46:18, Info DISM DISM Driver Manager: PID=3316 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-03-20 21:46:18, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\VBoxGuest.cat]" (Indicator: "vbox") "2019-03-20 21:46:18, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\VBoxGuest.cat]" (Indicator: "vboxguest")46:T458,"ScreenWings.exe" called "EnumWindows" with parameter "26205668" - (UID: 00000000-00004104) "ScreenWings.exe" called "EnumWindows" with parameter "26207320" - (UID: 00000000-00004104) "ScreenWings.exe" called "EnumWindows" with parameter "22928196" - (UID: 00000000-00007248) "ScreenWings.exe" called "EnumWindows" with parameter "22929848" - (UID: 00000000-00007248) "ScreenWings.exe" called "EnumWindows" with parameter "26204884" - (UID: 00000000-00006540) "ScreenWings.exe" called "EnumWindows" with parameter "26206536" - (UID: 00000000-00006540) "ScreenWings.exe" called "EnumWindows" with parameter "5233476" - (UID: 00000000-00008864) "ScreenWings.exe" called "EnumWindows" with parameter "5235128" - (UID: 00000000-00008864) "ScreenWings.exe" called "EnumWindows" with parameter "10344628" - (UID: 00000000-00008836) "ScreenWings.exe" called "EnumWindows" with parameter "10346280" - (UID: 00000000-00008836) "ScreenWings.exe" called "EnumWindows" with parameter "10410612" - (UID: 00000000-00008124) "ScreenWings.exe" called "EnumWindows" with parameter "10412264" - (UID: 00000000-00008124)47:T587,Observed system executable string:"vm3dservice (C:\Windows\System32\vm3dservice.exe)" [Source: Error.txt] Observed system executable string:"dwm (C:\Windows\System32\dwm.exe)" [Source: Error.txt] Observed system executable string:"WmiPrvSE (C:\Windows\System32\wbem\WmiPrvSE.exe)" [Source: Error.txt] Observed system executable string:"RuntimeBroker (C:\Windows\System32\RuntimeBroker.exe)" [Source: Error.txt] Observed system executable string:"conhost (C:\Windows\System32\conhost.exe)" [Source: Error.txt] Observed system executable string:"msdtc (C:\Windows\System32\msdtc.exe)" [Source: Error.txt] Observed system executable string:"fontdrvhost (C:\Windows\System32\fontdrvhost.exe)" [Source: Error.txt] Observed system executable string:"dllhost (C:\Windows\System32\dllhost.exe)" [Source: Error.txt] Observed system executable string:"winlogon (C:\Windows\System32\winlogon.exe)" [Source: Error.txt] Observed system executable string:"wermgr (C:\Windows\System32\wermgr.exe)" [Source: Error.txt] Observed system executable string:"taskhostw (C:\Windows\System32\taskhostw.exe)" [Source: Error.txt] Observed system executable string:"sihost (C:\Windows\System32\sihost.exe)" [Source: Error.txt] Observed system executable string:"ctfmon (C:\Windows\System32\ctfmon.exe)" [Source: Error.txt] Observed system executable string:"smartscreen (C:\Windows\System32\smartscreen.exe)" [Source: Error.txt]48:T5ca,"ScreenWings.exe" called "CryptAcquireContextW" with parameters {"phProv": "f8e8c00100000000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "ScreenWings.exe" called "CryptAcquireContextW" with parameters {"phProv": "78d78e0100000000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "ScreenWings.exe" called "CryptAcquireContextW" with parameters {"phProv": "085cb70100000000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "ScreenWings.exe" called "CryptAcquireContextW" with parameters {"phProv": "4093630000000000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "ScreenWings.exe" called "CryptAcquireContextW" with parameters {"phProv": "d05aa90100000000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "ScreenWings.exe" called "CryptAcquireContextW" with parameters {"phProv": "4808bf0100000000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "ScreenWings.exe" called "CryptAcquireContextW" with parameters {"phProv": "b033ad0100000000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"}49:T4f6,Found more than 2 POST requests like this POST /RST2.srf HTTP/1.0Connection: Keep-Alive Content-Type: application/soap+xml Accept: */* User-Agent: MSAWindows/45 (OS 10.0.22621.0.0 ni_release; IDK 10.0.22621.1 ni_release; Cfg 16.000.29325.00; Test 0) Content-Length: 4694 Host: login.live.com with payload ==> nul 2>&1\" (Indicator: \"tasklist \") in Source: 00000000-00001676.00000001.93838.07A40000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"ScreenWings.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001676.00000001.93838.00C42000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \",RtlGetVersion,NTDLL.dll,\"00:24:04.546\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001676.00000001.93838.00790000.00000004.mdmp, 00000000-00001676.00000002.95759.00790000.00000004.mdmp\")\n Found reference to API \",RtlGetVersion,NTDLL.dll,\"00:24:53.156\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004112.00000001.97269.00800000.00000004.mdmp, 00000000-00004112.00000002.99190.00800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"76932071068,3716,111,,GetSystemMetrics,user32.dll,\"00:25:16.921\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004112.00000001.97269.00800000.00000004.mdmp\")\n Found reference to API \"65698257232,3716,111,,GetSystemMetrics,user32.dll,\"00:25:12.250\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004112.00000001.97269.00800000.00000004.mdmp, 00000000-00004112.00000002.99190.00800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$41","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"ScreenWings.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"ScreenWings.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"ScreenWings.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007960)\n \"ScreenWings.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001676)\n \"ScreenWings.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004332)\n \"ScreenWings.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002184)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$42","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeL\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001676.00000001.93838.08549000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetKernelObjectSecurity\" (Indicator: \"SetKernelObjectSecurity\"; Source: \"00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp\")\n Found reference to API \"GetKernelObjectSecurity\" (Indicator: \"GetKernelObjectSecurity\"; Source: \"00000000-00004112.00000001.97269.05620000.00000004.mdmp, 00000000-00004112.00000002.99190.05620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$43","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"ScreenWings.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")\n \"ScreenWings.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\SCREENWINGS.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ScreenWings.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\ScreenWings.exe.log]- [targetUID: 00000000-00007636]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ScreenWings.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ScreenWings.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$44","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Tries to save executable or command in registry","description":"\"ScreenWings.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SCREENWINGS\"; Value: \"\"C:\\ScreenWings.exe\" -autostart\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"ScreenWings.exe\" has section name with entropy \"7.96733609354\"\n \"ScreenWings.exe\" has section name with entropy \"7.9093956861\"\n \"ScreenWings.exe\" has section name .rsrc with entropy \"7.09148547907\"\n \"ScreenWings.exe\" has section name .boot with entropy \"7.9538374148\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"ScreenWings.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"ScreenWings.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")\n \"ScreenWings.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMMANUFACTURER\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"ScreenWings.exe\" reads file \"C:\\ScreenWings.ini\"\n \"ScreenWings.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"ScreenWings.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"ScreenWings.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"ScreenWings.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"ScreenWings.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"ScreenWings.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"ScreenWings.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"ScreenWings.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SCREENWINGS\"; Value: \"\"C:\\ScreenWings.exe\" -autostart\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"ScreenWings.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"ScreenWings.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"ScreenWings.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"ScreenWings.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"ScreenWings.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"tasklist | find /i \"ScreenWings\" >nul 2>&1\" (Indicator: \"tasklist\"; Source: \"00000000-00001676.00000001.93838.07A40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ScreenWings.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"ScreenWings.exe\" called \"CreateProcessW\" with parameter \"\"C:\\ScreenWings.exe\"\" - (UID: 00000000-00007960)\n \"ScreenWings.exe\" called \"CreateProcessW\" with parameter \"\"C:\\ScreenWings.exe\"\" - (UID: 00000000-00001676)\n \"ScreenWings.exe\" called \"CreateProcessW\" with parameter \"\"C:\\ScreenWings.exe\"\" - (UID: 00000000-00004332)\n \"ScreenWings.exe\" called \"CreateProcessW\" with parameter \"\"C:\\ScreenWings.exe\"\" - (UID: 00000000-00002184)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"ScreenWings.exe\" wrote 00000004 bytes to a remote process \"C:\\ScreenWings.exe\" (Handle: 1972)\n \"ScreenWings.exe\" wrote 00000004 bytes to a remote process \"C:\\ScreenWings.exe\" (Handle: 1964)\n \"ScreenWings.exe\" wrote 00000004 bytes to a remote process \"C:\\ScreenWings.exe\" (Handle: 1944)\n \"ScreenWings.exe\" wrote 00000004 bytes to a remote process \"C:\\ScreenWings.exe\" (Handle: 1976)\n \"ScreenWings.exe\" wrote 00000004 bytes to a remote process \"C:\\ScreenWings.exe\" (Handle: 1880)\n \"ScreenWings.exe\" wrote 00000004 bytes to a remote process \"C:\\ScreenWings.exe\" (Handle: 1680)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"ScreenWings.exe\" (UID: 00000000-00007960)\n Spawned process \"ScreenWings.exe\" (UID: 00000000-00001676)\n Spawned process \"ScreenWings.exe\" (UID: 00000000-00004332)\n Spawned process \"ScreenWings.exe\" (UID: 00000000-00002184)\n Spawned process \"ScreenWings.exe\" (UID: 00000000-00007636)\n Spawned process \"ScreenWings.exe\" (UID: 00000000-00003720)\n Spawned process \"ScreenWings.exe\" (UID: 00000000-00004112)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crt.usertrust.com\"\n \"ocsp.sectigo.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"dismhost.exe.61556ECE.bin\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"dismhost.exe.61556ECE.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$45","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"dismhost.exe.61556ECE.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"dismhost.exe.61556ECE.bin\" claimed CRC 103114 while the actual is CRC 4213987","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004972.00000001.71385.03700000.00000004.mdmp, 00000000-00004972.00000002.73305.03700000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004972.00000001.71385.03700000.00000004.mdmp, 00000000-00004972.00000002.73305.03700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"$46","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"ScreenWings.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"ScreenWings.exe\" issued a query \"$objects\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00004972.00000001.71385.03700000.00000004.mdmp\n 00000000-00004972.00000002.73305.03700000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"ScreenWings.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"IO.IO_CannotCreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004972.00000001.71385.03700000.00000004.mdmp, 00000000-00004972.00000002.73305.03700000.00000004.mdmp\")\n Found reference to API \"IsolatedStorage_CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004972.00000001.71385.03700000.00000004.mdmp, 00000000-00004972.00000002.73305.03700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"FileStream was asked to open a device that was not a file. For support for devices like 'com1:' or 'lpt1:', call CreateFile, then use the FileStream constructors that take an OS handle as an IntPtr.\" (Indicator: \"CreateFile\"; Source: \"00000000-00004972.00000001.71385.03700000.00000004.mdmp, 00000000-00004972.00000002.73305.03700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"at System.Windows.Forms.Control.WmShowWindow(Message& m)\" (Indicator: \"ShowWindow\"; File: \"Error.txt\")\n Found reference to API \"at System.Windows.Forms.Form.WmShowWindow(Message& m)\" (Indicator: \"ShowWindow\"; File: \"Error.txt\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$47","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"pop.\" [Source: 00000000-00004960.00000000.71002.014E0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"IsolatedStorage_DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004972.00000001.71385.03700000.00000004.mdmp, 00000000-00004972.00000002.73305.03700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"winlogon.exe,ctfmon.exe,smss.exe,csrss.exe,wininit.exe\" (Source: \"00000000-00001848.00000002.72457.01E80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker (C:\\Windows\\System32\\RuntimeBroker.exe)\" (Indicator: \"runtimebroker.exe\")\n \"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"$48","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"ScreenWings.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00004104)\n \"ScreenWings.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00007248)\n \"ScreenWings.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00006540)\n \"ScreenWings.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00008864)\n \"ScreenWings.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00008836)\n \"ScreenWings.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00001848)\n \"ScreenWings.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00008124)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"ScreenWings.exe\" issued a query \"select * from Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Network Related","name":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)","description":"$49","origin":"Network Traffic","mitre_attack_id":"T1030","relevance":5,"id":"network-68","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"C:\\ScreenWings.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE (C:\\Windows\\System32\\wbem\\WmiPrvSE.exe)\" (Indicator: \"wmiprvse.exe\"; in File: \"Error.txt\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00001848.00000002.72457.01E80000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004960.00000000.71002.01B20000.00000004.mdmp\")\n Found string \"ow64\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004972.00000000.69468.005F0000.00000004.mdmp, 00000000-00004972.00000001.71385.005F0000.00000004.mdmp, 00000000-00004972.00000002.73305.005F0000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004972.00000000.69468.01630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"ScreenWings.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"ScreenWings.exe\" issued a query \"$objects\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Hooks key cryptographic functions of the CryptoAPI"}],"sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries firmware table information (may be used to fingerprint/evade)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Reads the active computer name"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]}]},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":53,"imported_dlls_count":137,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":68,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","windows-server-utility"],"sample_flags":["User Comment","Multi-Process","Extracted Files","Network Traffic"],"sandbox_reports":[{"id":"673b7f5fe4dc1abc0e070609","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"ScreenWings.exe","analysis_start_time":"2024-11-18T17:54:41+00:00","indicators_count":{"informative":118,"suspicious":35,"malicious":5},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"65eae6a9586d62c0a301a553","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"ScreenWings.exe","analysis_start_time":"2024-03-08T10:21:30+00:00","indicators_count":{"informative":115,"suspicious":37,"malicious":5},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"61556d9778945b77043bb5bd","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"no specific threat","malware_family":"Malware.Generic","contacted_countries":["GBR","USA"],"submit_name":"ScreenWings.exe","analysis_start_time":"2021-09-30T07:56:18+00:00","indicators_count":{"informative":16,"suspicious":18,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"612b564579c86872895a80de","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":70,"malware_family":"Malware.Generic","submit_name":"ScreenWings.exe","analysis_start_time":"2021-08-29T09:41:28+00:00","indicators_count":{"informative":8,"suspicious":13,"malicious":5},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5ed533e7cf35ab5339142e17","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"W32.Trojan","submit_name":"ScreenWings.exe","analysis_start_time":"2020-06-01T16:59:26+00:00","indicators_count":{"informative":7,"suspicious":15,"malicious":6},"tags":["User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"crt.usertrust.com","address":"91.199.212.52","ttl":398,"country":"United Kingdom","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Comodo Group, Inc.","registrar_name_servers":"NS0.COMODODNS.COM","registrar_creation_date":"1997-12-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"domain":"ocsp.sectigo.com","address":"104.18.30.182","ttl":3600,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}],"processes":[{"pid":4104,"ppid":0,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","uid":"00000000-00004104","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABiElEQVR4XmNgGAUDDd4Yaf1HF6M7eGek/b+egWHgHAJyAAyjy9EFvNTXgjsAhN8aDoBDkB0wYKGB7gBwaNDbIe/0UKMDhvfTO5GiO2BAouWhrhyGA0D4jYHG/+Cciv/BuZThgOwK3B4CWwTNDegOgIVEcG7lf0qwb3IefgegBzu62PpLD/6Tiwk6AASw+RqUK0BsEP3IxxMjZHZv3gu2oHVH/P/UpYwYmCQHwCxDxm9UVODRAqNp5gAQAJWK6JbALAcBdHGqOwAG0C0C4bfAmnTVsUf/111BYPS4xoVJdgAIYIsSkHjqynP/YXgD1IJ9R2f+P7E7BQNT5IDn+uoY8f7WUOu/VseB/5pQvOEyxIJTu+L+313BgIEpcgCyr9+ghQJdHACKc2Sfg8To6gAQwJYG3upp/F934R5GQsOHyXbAfXl5jIQIcwh6UUsIk+UAGMDmABhwiUz57xKRTL7hxAJcjqCbA2BgwB0AAqBCClR9u0Qm/wc7AAmjq6U5cAY6Ahmjy4+CQQUAA2NTnsq6X9QAAAAASUVORK5CYII="},{"pid":7248,"ppid":4104,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00004104","uid":"00000000-00007248"},{"pid":1848,"ppid":7248,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00007248","uid":"00000000-00001848"},{"pid":8124,"ppid":7248,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00007248","uid":"00000000-00008124"},{"pid":4960,"ppid":8124,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00008124","uid":"00000000-00004960"},{"pid":8444,"ppid":8124,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00008124","uid":"00000000-00008444"},{"pid":6540,"ppid":4104,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00004104","uid":"00000000-00006540"},{"pid":8864,"ppid":6540,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00006540","uid":"00000000-00008864"},{"pid":7528,"ppid":8864,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00008864","uid":"00000000-00007528"},{"pid":8804,"ppid":8864,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00008864","uid":"00000000-00008804"},{"pid":8836,"ppid":6540,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00006540","uid":"00000000-00008836"},{"pid":7976,"ppid":8836,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00008836","uid":"00000000-00007976"},{"pid":4972,"ppid":8836,"name":"ScreenWings.exe","command_line":"","sha256":"481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214","normalized_path":"C:\\ScreenWings.exe","parent_uid":"00000000-00008836","uid":"00000000-00004972"}],"all_imported_dlls":["dwmapi.dll","wow64cpu.dll","user32.dll","RpcRtRemote.dll","gdi32.dll","sspicli.dll","cryptbase.dll","vcruntime140_clr0400.dll","System.ni.dll","kernel32.dll","lpk.dll","rpcrt4.dll","rsaenh.dll","shlwapi.dll","ucrtbase_clr0400.dll","Microsoft.VisualBasic.ni.dll","System.Drawing.ni.dll","oleaut32.dll","wow64.dll","nsi.dll","api-ms-win-core-xstate-l2-1-0.dll","clrjit.dll","System.Windows.Forms.ni.dll","System.Xml.ni.dll","cryptsp.dll","KernelBase.dll","api-ms-win-core-synch-l1-2-0.dll","wow64win.dll","version.dll","profapi.dll","comctl32.dll","System.Runtime.Remoting.ni.dll","mscorrc.dll","usp10.dll","sechost.dll","ole32.dll","mscoreei.dll","clr.dll","ntdll.dll","msvcrt.dll","psapi.dll","bcrypt.dll","mscoree.dll","System.Management.ni.dll","clbcatq.dll","shell32.dll","mscorlib.ni.dll","System.Core.ni.dll","nlssorting.dll","advapi32.dll","imm32.dll","msctf.dll","ws2_32.dll","uxtheme.dll","System.Configuration.ni.dll","GdiPlus.dll","msvcr120_clr0400.dll","rpcss.dll","sppc.dll","fltLib.dll","msvcp_win.dll","slc.dll","cfgmgr32.dll","powrprof.dll","TextInputFramework.dll","System.Windows.Forms.dll","WindowsCodecs.dll","propsys.dll","urlmon.dll","iertutil.dll","VxSSL32.dll","System.Drawing.dll","Windows.StateRepositoryPS.dll","kernel.appcore.dll","wintrust.dll","Accessibility.dll","bcryptprimitives.dll","ucrtbase.dll","DWrite.dll","wldp.dll","System.Deployment.dll","crypt32.dll","System.Management.dll","CoreUIComponents.dll","windows.storage.dll","amsi.dll","CoreMessaging.dll","ntmarta.dll","win32u.dll","msasn1.dll","aepic.dll","userenv.dll","WinTypes.dll","combase.dll","MpOAV.dll","System.Runtime.Remoting.dll","imagehlp.dll","msIso.dll","MpClient.dll","gpapi.dll","edputil.dll","SHCore.dll","cldapi.dll","gdi32full.dll","Microsoft.VisualBasic.dll","dbghelp.dll","DismProv.dll","devobj.dll","LogProvider.dll","wdscore.dll","SPInf.dll","DismCorePS.dll","SSShim.dll","OSProvider.dll","CbsCore.dll","DrUpdate.dll","drvstore.dll","setupapi.dll","devrtl.dll","DmiProvider.dll","mpr.dll","WMINet_Utils.dll","wbemsvc.dll","wow64con.dll","TextShaping.dll","netutils.dll","fastprox.dll","wbemcomn.dll","wow64base.dll","srvcli.dll","virtdisk.dll","AppResolver.dll","diasymreader.dll","wmiutils.dll","wbemprox.dll","BCP47Langs.dll","OneCoreUAPCommonProxyStub.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ScreenWings.exe.log","sha256":"06645e109caa4118bf48c04c376cb752a4d37a6fce5eee43fc5a74acd6db69ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"ScreenWings.ini","sha256":"5d0945af4022cd36892e714781a97f16153e302634c7766e4e2ecf57c9539eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Error.txt","sha256":"c4dd758fd1d7f97a5eab83eeee6efa9bbe68b2474900587f281960c1b1f38cf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"dismhost.exe.61556ECE.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"name":"dism.log","sha256":"108ee778ca3494df66a892448297b0e23831d33e2cfe35a963ffa0ed47c8fc19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]}],"files_written":[{"path":"C:\\ScreenWings.exe","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"C:\\ScreenWings.exe.config","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\0b2f69b43a576b9edcc807a30872bd91\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\fd0048cfdcd58dd454d2575e5cb55e70\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\verdanab.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\verdanai.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\verdanaz.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\assembly\\pubpol247.dat","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\1c459c609c9edf4427ae91b4293b0d0a\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\7aa0dcace3b5d10b626540709537d280\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb36278a0a934ae244f843b62229421c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\3c20a6b0ca532bcc6271bf4b7ad0b4d9\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\ce9750286ad44cbfb2acf176df9df0a2\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\bf505bb2c2b60e7a40740888cd2c3172\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\87f2fdbe093d6be28c051bd351aa39dd\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\c19db88873f99eb2f7660bd1fe2f6b71\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"C:\\ScreenWings.ini","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\ScreenWings.exe.log","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"path":"%WINDIR%\\TEMP\\44C121DA-84FB-4524-BBFA-7DCE623E793A\\en-US\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\TEMP\\44C121DA-84FB-4524-BBFA-7DCE623E793A\\en\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Logs\\DISM\\dism.log","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.23505_none_0bfc08bf3ea166ba\\CbsCore.dll","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\inf\\oem10.inf","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_x86_neutral_d851dfe6e8880beb\\vboxvideo.PNF","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\Temp\\44C121DA-84FB-4524-BBFA-7DCE623E793A\\en-US\\DmiProvider.dll.mui","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_x86_neutral_d851dfe6e8880beb\\VBoxVideo.inf","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\inf\\oem9.inf","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"path":"C:\\Error.txt","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"612b564579c86872895a80de"},{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5ed533e7cf35ab5339142e17"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7960:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:7960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:7960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:7960:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:1676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:1676:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:1676:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:1676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:4332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:4332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:4332:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:4332:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:2184:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:2184:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:2184:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:2184:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:7636:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:7636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:7636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Global\\{7e3fd23f-1c67-4c75-9169-ebcda3180d6e}","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"},{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:3720:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:3720:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:3720:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"Local\\SM0:4112:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:4112:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"SM0:4112:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673b7f5fe4dc1abc0e070609"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"name":"\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"61556d9778945b77043bb5bd"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:4104:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:4104:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:4104:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:7248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:7248:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:7248:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:6540:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:6540:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:6540:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:8864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:8864:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:8864:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:8836:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:8836:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:8836:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:1848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:1848:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:1848:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:8124:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"SM0:8124:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]},{"name":"Local\\SM0:8124:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65eae6a9586d62c0a301a553"}]}]}},"report_ids":{"sandbox_job_ids":["5ed533e7cf35ab5339142e17","612b564579c86872895a80de","673b7f5fe4dc1abc0e070609","65eae6a9586d62c0a301a553","61556d9778945b77043bb5bd"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Convagent Sample 481ecd41bef2… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 481ecd41bef2…. Malware family: Trojan.Convagent. Threat score 76/100. 4/28 AV engines flagged this file. 9 malicious and 33 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Convagent Sample 481ecd41bef2… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 481ecd41bef2…. Malware family: Trojan.Convagent. Threat score 76/100. 4/28 AV engines flagged this file. 9 malicious and 33 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Convagent Sample 481ecd41bef2… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 481ecd41bef2…. Malware family: Trojan.Convagent. Threat score 76/100. 4/28 AV engines flagged this file. 9 malicious and 33 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4a","11",{}]]