24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T41f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 4e3f99b17e12… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 4e3f99b17e12…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","keywords":["malware analysis","sandbox report","threat intelligence","4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26"],"about":{"@type":"SoftwareApplication","name":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","applicationCategory":["peexe","assembly","executable"],"identifier":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tca8,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES")26:T259e,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000300045000000183a35000000000045000000000000001400000000000000000000000000000000000000000000000200000210e83400ba7600cc0000000000000000000000008000000000000000ba7600cc183a35000100000000000000020000000c00000010373500103735000b3735000000000000000000000030000000000124f4220000000000acf5220095e16c77a0481600feffffff435c70775059707794000000a00000000a3735000837350094000000e0f52200fdfe597748f52200ec29306c5c0c000064f52200ff29306c00000000000000000000000000000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006491ed64000000006491ed640000000080f322009f486d776691ed6400000000a0f32200000000006691ed64a4f322004da389750000000000000000a0f322006491ed64000000000000000004000000d0f322000fa389756491ed64020000000000000000000000080000006491ed64ffffffff010000800200000020f4220042a28975e9fd0000080000006491ed64020000000000000001000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000407400345c000000e84d3500c400300002005900200000000000300000000000086d3000ecfa22000c000000380130000000000020ec3300f8693000106b300040bd3400f06d3000020000000000000048000000f0fa22006cfa22002c48e16400003000000000004b48e164fa1effb5010000002c8d376500000000184235001342350000000000a8fa220060173065ffffffff4b48e164aa48e164000030000000000040000000b4fa2200e543e16430c43400e848e164221effb5010000002c8d376500000000cb00000002000000dcfa2200a0fb3165ffffffffe848e164 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006b002000310000000000407400345c000000e84d3500c400300002005900200000000000300000000000086d3000ecfa22000c000000380130000000000020ec3300f8693000106b300040bd3400f06d3000020000000000000048000000f0fa22006cfa22002c48e16400003000000000004b48e164fa1effb53f87ed64fa1effb5010000002c8d376500000000d4fa220088fa220028762d65ffffffff3f87ed645d87ed64021effb5010000002c8d376500000000d4fa2200b0fa220028772d65ffffffff5d87ed647b87ed642a1effb5010000002c8d376500000000d4fa2200 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000035000100010008f92200dcf82200dcf82200245971770000000038f922000cb7ff6408f922000600000054f922000c876d77000000000200000054f92200626f707734876d77dca3447714d5376572c659770000000001000100060000000000000008d53765d838350075d8306c50de376500000000bacb2bccb616f34c8990d74c2e8af500dca34477f8f8220000000000dcfa220095e16c7730461600feffffff34876d77c4b6ff644096ff6430c43400fcb6ff640100000090f92200d9b6ff641cd537650100000030c43400bcce5977000000000000000000000000bcfa2200 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000300020000000a050350000000000200000000000000014000000000000000000000000000000000000000000000002000002300d3400e973009a0000000000000000000000008000000000000000e973009aa05035000100000000000000020000000c00000038353500383535003335350000000000000000000000300000000001c0f4220000000000dcfa220095e16c77a0481600feffffff435c70775059707794000000a000000032353500303535009400000064f62200fdfe5977e4f52200ec29306c5c0c000000f62200ff29306c00000000000000000000000000000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000d2000000d20000000c0000003823370001000000020000000200000010000000d426376501000000383d37650100000048f22200d8f12200de44e1642013360008f222009f44e164b844e1649e16ffb53036340048f2220001000000000000000000000024f222001ce33065ffffffffb844e1647d44e164a616ffb53036340018003700010000008a41e764e616ffb530363400c02a360000000000739fe664fe16ffb530363400c02a360000000000383d376500000000e1a7e6640000000030363400 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000030393700c08037001a007a0001000000000000003ceb00010000000070000000086d300038ea220020000000a0eb220000000000f04a3700f8693000186b3000785a3700c06e30003c6e7077bcea220000000000f0eb2200785a3700e9e97077785a3700000000002000000000000000000000000800000002000000b0eb220072dc59770000000079dc5977a726e3bd38b184750000000000008275000000000000000004ec220028ec2200c715d5750000000048ff33000000000068eb22007ceb2200dcec220002000000000000002800000079dc597700ec2200c9768975 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001100000040178d0000008d00e0178d00000000003016c16b000000003016c16b00000000ecea22009f486d773216c16b000000000ceb2200000000003216c16b10eb22004da3897500000000000000000ceb22003016c16b0000000000000000040000003ceb22000fa389753016c16b020000000000000000000000080000003016c16bffffffff01000080020000008ceb220042a28975e9fd0000080000003016c16b020000000000000001000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002200fcdf22000200000002000000010042000500000000000000000000000000000060e12200547770773ce022000000000014000000bf7770770000396a0000000000008000bce02200f000396a00000000000000000000000000000000000000000000000000000000000000001200140014e22200e4e122000100000000000000ff2b707778ba447700000000940130000000300088bb4477c0713f6a0000ffff3f00000000000000000000000700d90044010000010068003f0000003ce1220020000000086d30004401000001000000020000000000000000ec3300f8693000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002200782f4f00d0e9220080f41e7700004f000000000089f41e776f16febd0200000044ea220040ea220074ea220050ea2200cea1ad00000000000000100094e92200c83a287708ea2200d58c207744ea2200d8e9220042a41e77a802287718ea2200d2f41e77080000006ef51e7744f51e77a715febd02000000ec36da75000023004548da75ece922000200000000002300ec36da751cea220042a41e77a802287760ea2200c035da75080000009535da75ca8ae3b502000000ec36da75000023004548da75902f4f00782f4f002cea2200e061dc75ecea22001ed8da7532551bc0 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000064006400350032003900650061006600330033003900340034006400340035003600650037003400310032006500300039003700650066003200380039003100610065003100640066006200320036002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b707730b04477d8eb4677ac01300000003000000000000000000020005b018a00000000000000000000000000000000000000210056018a0000000000000000000000086d30000000000020000000000000000000000050a83c00f8693000186b300098d63c00c06e3000 (UID: 00000000-00004020)27:T128e,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100005300780053005c007800380036005f006d006900630072006f0073006f00660074002e0076006300380030002e006300720074005f0031006600630038006200330062003900610031006500310038006500330062005f0038002e0030002e00350030003700320037002e0034003900 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d226c00008d00000000006c6d226c7e1affb5d8d7376530f522002cf522000000ab6b00000000ecf4220000000000d8d7376584f4220000f52200f4f4220030f52200c4f42200ff23226cc83b2b6c04f522003117226c080000001c5c6f7714a17077ffffffff24000000ecf42200 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000100000001000000000000000000000061006d0073005c0000000000000000000000000000000000010000002f0000000000000000000000330032005c0053006300720069007000740073000000000000003a000000000000000000000000000000000000000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100754cec2200502d8275785a370000000000000000006cec22001c2d82750000827501000000000000000100000001000000010000008cec220034298275000082750100000000000000bced22000000000001000000000000000100000000008275010000000000000000000000acec2200 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006c20ec22003117226c080000001c5c6f7714a17077ffffffff2400000008ec220004000000000000000100000034f9c16b0100000054ec2200935c717740837877d4a07077dcb64477000000000100000001000000303734000000000024ec22001bc6597790ec220095e16c77705e1600 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000b000000a4e12200b0e1220002000000000000001000000094e12200b0e12200c97689750000300000001400da7689757d2de3bd000000000000396a01000000935c717700000000000000000000000078e122000100000048e42200bd068b752dba48c800000000bd14396ad0a83400 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb467798d63c000070fd7f9a5c717700f0fd7f78eb22004470fd7f00000000400000003f000000210000000070fd7f6ceb2200c15c717760827877210000000070fd7f9a5c717700f0fd7f90eb2200578970778083787713178a75d8eb4677 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000040000000100000000020000000600000300000000000000180000000000cf6dee297077834d226c00008d00000000000c0000005cf3220044ef220054ea220000000000300e256c0c000000cd523f6a64163f6a00000000 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000060142b04100000000000000098ea220050dcba7660142b041000000064142b040000000010000000030000000000000018000000a353a89aee297077834d226c00008d00000000000c0000006ced2200fcef2200e0ea220000000000300e256c0c000000954f3f6ab05a2b04a8ee2200 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310064506c3f6444f2e1644cee2200660dfebd28e922004493e2646cf1220015de8677fe2554cafeffffff030000000000000018000000fe421f72ee297077834d226c00008d00000000000c000000fcef220064f0220080ed220000000000300e256c0c000000fcef220095130572f354a89a (UID: 00000000-00004020)28:Td34,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")29:T865,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")2a:T2df6,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter RichEd20.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter mscorsec.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter imagehlp.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\\wminet_utils.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\VERSION.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter C:\4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00004020)2b:Td277,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetPublisher (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoInitializeEE (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoInitializeEE_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CORPolicyEE (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptSIPPutSignedDataMsg (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptSIPGetSignedDataMsg (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ImageGetCertificateData (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WVTAsn1SpcIndirectDataContentDecode (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptSIPVerifyIndirectData (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WVTAsn1SpcPeImageDataDecode (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SaferiSearchMatchingHashRules (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoUninitializeEE (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoUninitializeEE_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ZeroMemory (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ZeroMemoryA (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004020) "dw20.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004376) "dw20.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004376) "dw20.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00004376) "dw20.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00004376) "dw20.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00004376) "dw20.exe" called "GetProcAddress" with a parameter DuplicateToken (UID: 00000000-00004376)2c:T64c,Found reference to API (Indicator: "CompareString"; File: "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26") Found reference to API (Indicator: "CreateDirectory"; File: "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26") Found reference to API (Indicator: "Sleep"; File: "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26") Found reference to API (Indicator: "GetCurrentProcess"; File: "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26") Found reference to API (Indicator: "GetObject"; File: "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26") Found reference to API (Indicator: "CompareString"; Source: "00000000-00004020.00000001.130727.00AB2000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00004020.00000001.130727.00AB2000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004020.00000001.130727.00AB2000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004020.00000001.130727.00AB2000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004020.00000001.130727.00AB2000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004020.00000001.130727.00AB2000.00000020.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00004020.00000001.130727.020F0000.00000004.mdmp")2d:T59e,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\VERSION.dll" - [base:0; Status:c0000135]2e:T5edc,"EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004020.00000001.130727.00300000.00000004.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ar-SA\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\cs-CZ\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\da-DK\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\de-DE\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\el-GR\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\en-US\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\es-ES\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\fi-FI\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\fr-FR\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\he-IL\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\hr-HR\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\hu-HU\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\it-IT\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ja-JP\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ko-KR\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\nb-NO\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\nl-NL\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pl-PL\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pt-BR\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pt-PT\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ru-RU\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sk-SK\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sl-SL\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sv-SE\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\tr-TR\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-CN\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-HK\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-TW\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\bg-BG\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ca-ES\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\et-EE\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\lt-LV\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\lv-LV\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ro-RO\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sr-BA\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\th-TH\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\uk-UA\Titles]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ar-SA]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\cs-CZ]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\da-DK]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\de-DE]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\el-GR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\en-US]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\es-ES]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\fi-FI]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\fr-FR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\he-IL]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\hr-HR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\hu-HU]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\it-IT]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ja-JP]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ko-KR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\nb-NO]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\nl-NL]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pl-PL]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pt-BR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pt-PT]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ru-RU]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sk-SK]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sl-SL]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sv-SE]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\tr-TR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-CN]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-HK]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-TW]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\bg-BG]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ca-ES]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\et-EE]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\lt-LV]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\lv-LV]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ro-RO]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sr-BA]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\th-TH]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\uk-UA]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\TopicProperties]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\TopicProperties\mshelp://help/?id=escalation]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\TopicProperties\mshelp://help/?id=home]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\TopicProperties]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ar-SA]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\cs-CZ]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\da-DK]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\de-DE]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\el-GR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\en-US]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\es-ES]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\fi-FI]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\fr-FR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\he-IL]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\hr-HR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\hu-HU]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\it-IT]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ja-JP]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ko-KR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\nb-NO]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\nl-NL]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pl-PL]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pt-BR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\pt-PT]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ru-RU]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sk-SK]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sl-SL]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sv-SE]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\tr-TR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-CN]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-HK]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\zh-TW]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\bg-BG]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ca-ES]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\et-EE]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\lt-LV]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\lv-LV]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\ro-RO]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\sr-BA]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\th-TH]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Assistance\Client\1.0\Namespaces\OEM\uk-UA]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\ar]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\cs]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\da]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\de]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\el]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\en]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\es]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\fi]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\fr]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\he]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\hu]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\it]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\ja]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\ko]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\nl]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\no]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\pl]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\pt]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\pt-BR]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\pt-PT]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\ru]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\sk]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\sl]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\sv]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\th]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\tr]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\zh-CHS]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support\zh-TW]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "[-HKEY_LOCAL_MACHINE\SOFTWARE\HPQ\{4264742F-0322-4ba5-9657-A798C5C37AD6}\Main\HP Help and Support]" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "xport HKLM\Software\Microsoft\Assistance\Client\1.0\Namespaces\" in Source: 00000000-00004020.00000001.130727.00AB2000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\v2.0.50727" in Source: 00000000-00004020.00000001.130727.020F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\." in Source: 00000000-00004020.00000001.130727.020F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" in Source: 00000000-00004020.00000001.130727.020F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity" in Source: 00000000-00004020.00000001.130727.020F0000.00000004.mdmp2f:T2859,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d660000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 718d0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "KERNEL32" at base 77550000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "ADVAPI32.DLL" at base 75cf0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bab0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "SHLWAPI.DLL" at base 76f50000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "VERSION.DLL" at base 74a50000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64e10000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "USER32.DLL" at base 77480000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "MSCOREE.DLL" at base 6bb40000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "NTDLL" at base 776b0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "SHELL32.DLL" at base 75e70000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "OLE32.DLL" at base 76fb0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "KERNEL32.DLL" at base 77550000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77810000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "PROFAPI.DLL" at base 755c0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 64310000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "IMM32.DLL" at base 77830000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "RICHED20.DLL" at base 6a390000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORSEC.DLL" at base 6bc10000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "MSCORSEC.DLL" at base 6bc10000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "CRYPTSP.DLL" at base 74fc0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d50000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "CRYPTBASE.DLL" at base 754b0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "WINTRUST.DLL" at base 75820000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75610000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "IMAGEHLP.DLL" at base 75da0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "NCRYPT.DLL" at base 750f0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74c90000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "BCRYPT.DLL" at base 750d0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "USERENV.DLL" at base 755f0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "GPAPI.DLL" at base 74b90000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77810000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "RPCRT4.DLL" at base 77850000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77810000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 737d0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "CRYPTNET.DLL" at base 737d0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "SENSAPI.DLL" at base 6d650000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "WINHTTP.DLL" at base 71470000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "WS2_32.DLL" at base 76c70000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "SSPICLI.DLL" at base 75440000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "CREDSSP.DLL" at base 74c50000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f80000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "WSHTCPIP" at base 74ae0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "WSHIP6.DLL" at base 74f70000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 73900000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "IPHLPAPI.DLL" at base 73910000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "DHCPCSVC6.DLL" at base 73740000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "DHCPCSVC.DLL" at base 73700000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "NTDLL.DLL" at base 776b0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "NSI.DLL" at base 76c00000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "CFGMGR32.DLL" at base 757f0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "OLEAUT32.DLL" at base 76b60000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77810000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "DNSAPI.DLL" at base 74e40000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ae0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f70000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "RASADHLP.DLL" at base 6e100000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73810000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77810000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 6a7f0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 63b60000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 65620000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "RPCRTREMOTE.DLL" at base 75550000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\\WMINET_UTILS.DLL" at base 6a3f0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "CLBCATQ.DLL" at base 75de0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77550000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6e300000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f180000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73b00000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 6d990000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 6d480000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 6d470000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 721f0000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72040000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75460000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6c170000 "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 6a360000 "dw20.exe" loaded module "RPCRT4.DLL" at base 7785000030:T4f2,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")31:T4bd,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"32:Tb6d,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004020-00000C2B-293554071] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00004020-00000C2B-293912175] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00004020-00000C2B-295013075] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll" [Source: 00000000-00004020-00000C2B-295499020] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00004020-00000C2B-296177583] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00004020-00000C2B-296717484] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00004020-00000C2B-297447782] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00004020-00000C2B-305499127] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00004020-00000C2B-306181119] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00004020-00000C2B-306309698] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll" [Source: 00000000-00004020-00000C2B-306433161] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\\wminet_utils.dll" [Source: 00000000-00004020-00000C2B-306876763] Observed system executable string:"%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004020-00000C2B-307700129] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00004020-00000C2B-307933282] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\VERSION.dll" [Source: 00000000-00004020-00000C2B-308158594] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll" [Source: 00000000-00004020-00000C2B-309061677] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00004020-00000C2B-309187135] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00004020-00000C2B-309285949] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" [Source: 00000000-00004020-00000C2B-309388605] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll" [Source: 00000000-00004020-00000C2B-309614145]33:T400,The input sample is signed with a certificate issued by "CN=VeriSign Time Stamping Services CA, O="VeriSign Inc.", C=US" (SHA1: AD:A8:AA:A6:43:FF:7D:C3:8D:D4:0F:A4:C9:7A:D5:59:FF:48:46:DE; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: F4:6A:C0:C6:EF:BB:8C:6A:14:F5:5F:09:E2:D3:7D:F4:C0:DE:01:2D; see report for more information) The input sample is signed with a certificate issued by "OU=Class 3 Public Primary Certification Authority, O="VeriSign Inc.", C=US" (SHA1: 19:7A:4A:EB:DB:25:F0:17:00:79:BB:8C:73:CB:2D:65:5E:00:18:A4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa c04, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 90:CD:7E:BA:8F:57:B7:19:78:01:22:14:2B:38:EC:A8:3E:12:71:E4; see report for more information)34:T585,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: ""; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E972-E325-11CE-BFC1-08002BE10318}"; Key: ""; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD"; Key: ""; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-32-52"; Key: ""; Value: "")35:T1006,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")36:Tcfc,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\FLTLIB.DLL" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\MSVCP140.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\VCRUNTIME140.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\ucrtbase.DLL" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"37:T73f,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\mscorlib.pdb" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" touched file "C:\Windows\HPHASUtil.pdb"38:Tcf7,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\FLTLIB.DLL" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\MSVCP140.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\ucrtbase.DLL" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"39:T7b3,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe.config" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe.Local\" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}"3a:T62a,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\60e31627fda0a46932b0e5948949f2a5" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\60e31627fda0a46932b0e5948949f2a5" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\3c3948be6e525b8a8cee9fac91c9e392_5beb6c6453db87d996bdbc5d90d34ae1" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\3c3948be6e525b8a8cee9fac91c9e392_5beb6c6453db87d996bdbc5d90d34ae1" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\60e31627fda0a46932b0e5948949f2a5" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\3c3948be6e525b8a8cee9fac91c9e392_5beb6c6453db87d996bdbc5d90d34ae1" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\60e31627fda0a46932b0e5948949f2a5" "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\3c3948be6e525b8a8cee9fac91c9e392_5beb6c6453db87d996bdbc5d90d34ae1"3b:T520,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004020-00000C2C-299200509") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004020-00000C2C-300309740") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004020-00000C2C-300532997") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004020-00000C2C-300532997") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004020-00000C2C-300532997") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004020-00000C2C-301867401") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004020-00000C2C-301867401") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00004020-00000C2C-302080132") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00004020-00000C2C-302081016") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004020-00000C2C-302132987") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004020-00000C2C-302133479")3c:T17ce,Pattern match: "http://schemas.microsoft.com/help/toc/2004/11" Heuristic match: "hphelpupdater.my" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://crl.verisign.com/tss-ca.crl0" Pattern match: "crl.verisign.com/thawtetimestampingca.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "https://www.verisign.com/rpa01" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://csc3-2004-crl.verisign.com/csc3-2004.crl0d" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "csc3-2004-aia.verisign.com/csc3-2004-aia.cer0" Heuristic match: "namespaces\oem\da-dk][hkey_local_machine\software\microsoft\assistance\client\1.0\namespaces\oem\da-dk\titles]hp.npc.prjhomepage_da-dk=hp.npc.prjescalationpage_da-dk=hp.npc.prjart_da-dk=hp.npc.prjfaq_da-dk=hp.npc.prjpowerandbatterylearning" Heuristic match: "crl.verisign.com" Heuristic match: "ocsp.verisign.com" Heuristic match: "csc3-2004-crl.verisign.com" Pattern match: "microsoft.net/framework/v2.0.50727/" Heuristic match: ",gu2.gu" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://g.symcd.com0" Pattern match: "http://www.geotrust.com/resources/cps06" Pattern match: "http://g.symcb.com/geotrustpca-g3.crl0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://isrg.trustid.ocsp.identrust.com0" Pattern match: "http://apps.identrust.com/roots/dstrootcax3.p7c0" Pattern match: "http://cps.root-x1.letsencrypt.org0" Pattern match: "http://crl.identrust.com/dstrootcax3crl.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://www.usertrust.com1" Pattern match: "www.google.com0" Pattern match: "https://secure.comodo.com/cps0" Pattern match: "crl.comodoca.com/utn-userfirst-hardware.crl06" Pattern match: "crl.comodo.net/utn-userfirst-hardware.crl0q" Pattern match: "http://crt.comodoca.com/utnaddtrustserverca.crt0$" Pattern match: "http://ocsp.comodoca.com0%" Pattern match: "www.google.com" Pattern match: "http://www.public-trust.com/cps/omniroot.html0" Pattern match: "www.public-trust.com/cgi-bin/crl/2018/cdp.crl0" Pattern match: "http://ocsp.comodoca.com05" Heuristic match: "addons.mozilla.org" Pattern match: "www.addons.mozilla.org0" Pattern match: "2www.entrust.net/cps" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://crl.entrust.net/server1.crl0" Pattern match: "http://www.diginotar.nl/cps/pkioverheid0" Pattern match: "http://crl.pkioverheid.nl/domovlatestcrl.crl0" Pattern match: "http://ocsp.comodoca.com0/" Heuristic match: "login.skype.com" Pattern match: "www.login.skype.com0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0" Pattern match: "www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com" Pattern match: "www.verisign.com/repository/verisignlogo.gif0d" Heuristic match: "login.yahoo.com" Pattern match: "www.login.yahoo.com0" Heuristic match: "mail.google.com" Pattern match: "www.mail.google.com0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://ocsp.entrust.net0d" Pattern match: "http://www.digicert.com.my/cps.htm02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Heuristic match: "f.com" Pattern match: "http://ocsp.comodoca.com0-" Heuristic match: "login.live.com" Pattern match: "www.login.live.com0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "www.digicert.com1+0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "www.digicert.com1!0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.verisign.com/pca3.crl" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Heuristic match: "cdp1.digicert.com.akahost.net" Heuristic match: "cdp1.digicert.com.akadns.net" Heuristic match: "eip-terr-na.cdp1.digicert.com.akahost.net" Heuristic match: "cdp1.digicert.com.akamaized.net" Heuristic match: "mpki-ocsp.edge.digicert.com" Heuristic match: "mpki-ocsp.digicert.com" Pattern match: "http://csc3-2004-crl.verisign.com/csc3-2004.crl" Pattern match: "ocsp.verisign.com/mfewtzbnmeswstajbgurdgmcgguabbq%2fxkcfyhfjr7gq6m658nrz4sho%2faqucpvr6pv%2bpt1knnxoz1t4qn%2b5xtcceaizrth98blrumecg%2fzq%2fc8%3d" Heuristic match: "mpki-crl.edge.digicert.com" Heuristic match: "crl-symcprod.digicert.com"3d:T60c8,Found URL "http://ocsp.verisign.com0,0*0(" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.verisign.com/tss-ca.crl0tsa1-20u6t:!?da" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://ocsp.verisign.com0:08060http://crl.verisign.com/thawtetimestampingca.crl0tsa2048-1-530?7!op1ief8verisign," - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "https://www.verisign.com/rpa01*0(0&" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0class3ca2048-1-430==d6" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://csc3-2004-crl.verisign.com/csc3-2004.crl0d=0;090*0(https://www.verisign.com/rpa0i0g0$http://ocsp.verisign.com0?3http://csc3-2004-aia.verisign.com/csc3-2004-aia.cer0==d6" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9np1<92a@ef6" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c/i" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7verisign" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l$" - Source: "00000000-00004020.00000000.129949.00300000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crlcates\disallowed\phyle71a41988c6254f5fab385710b124:\windows\system32\userenv.dllicrosoft" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl:\windows\system32\wbem\wmiutils.dll:\windows\system32\wbem\wmiutils.dll:\windows\system32\wbem\wmiutils.dll:\windows\system32\wbem\wbemprox.dll:\windows\system32\wbem\wbemprox.dll:\windows\system32\wbem\wbemprox.dllecurity=impersonation" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://ocsp.verisign.com0,0*0(" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.verisign.com/tss-ca.crl0tsa1-20u6t:!?da" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://ocsp.verisign.com0?3http://cscdlistlistlistlistlistlistplistlistlistlistlistlistxz>listlistlistlistlistlistlistlistlisth" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://csc3-2004-crl.verisign.com/csc3-2004.crl0d=0;090*0(https://www.verisign.com/rpa0i0g0$http://ocsp.verisign.com0?3http://csc3-2004-aia.verisign.com/csc3-2004-aia.cer0==d6" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "https://www.verisign.com/rpa01*0(0&" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0class3ca2048-1-430==d6" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9np1<92a@ef6" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c/i" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7verisign" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*leuntdu5du,quuusuuuhhhsmookh]" - Source: "00000000-00004020.00000001.130727.00300000.00000004.mdmp") Found URL "http://csc3-2004-crl.verisign.com/csc3-2004.crlzq%2fc8%3dystem.managementicrosoft.jscriptystem.managementystem.managementicrosoft.jscriptegotiateerberoschannelaseidentitydentitytypemmcaspext.dlleip-terr-na.cdp1.digicert.com.akahost.netcrl.verisign.comttp://ocsp.verisign.com/mfewtzbnmeswstajbgurdgmcgguabbq%2fxkcfyhfjr7gq6m658nrz4sho%2faqucpvr6pv%2bpt1knnxoz1t4qn%2b5xtcceaizrth98blrumecg%2fzq%2fc8%3detwork" - Source: "00000000-00004020.00000001.130727.04280000.00000004.mdmp") Found URL "http://csc3-2004-crl.verisign.com/csc3-2004.crl[eip-terr-na.cdp1.digicert.com.akahost.netcdp1.digicert.com.akadns.neteip-terr-na.cdp1.digicert.com.akahost.netcdp1.digicert.com.akamaized.netcdp1.digicert.com.akadns.netmpki-crl.edge.digicert.comcdp1.digicert.com.akamaized.netcrl-symcprod.digicert.commpki-crl.edge.digicert.comcrl.verisign.comcrl-symcprod.digicert.comzq%2fc8%3dcrl.verisign.com8nrz4sho/aqucpvr6pv+pt1knnxoz1t4qn+5uth98blrumecg/zq/c8=csc3-2004-crl.verisign.comeip-terr-na.cdp1.digicert.com.akahost.netocsp.verisign.com:\windows\assembly\nativeimages_v2.0.50727_32\system.management\00c2b464e52d4e82c04d61592a12a89d\system.management.ni.dllwinsta0\defaultallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00004020.00000001.130727.04280000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00004020.00000001.130727.04280000.00000004.mdmp") Found URL "http://csc3-2004-crl.verisign.com/csc3-2004.crl0d=0;090*0(https://www.verisign.com/rpa0i0g0$http://ocsp.verisign.com0?3http://csc3-2004-aia.verisign.com/csc3-2004-aia.cer0==d6" - Source: "00000000-00004020.00000001.130727.04280000.00000004.mdmp")3e:Teac,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004020) "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004020)3f:T1006,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")40:T10a7,"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")41:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1791936129210,"unified_at":"2026-10-14T00:02:09.210Z","metadata":{"hashes":{"sha256":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","sha1":"126b831472a0b33b92963ff7eb659228f3b57409","md5":"04975a250f46e96a9d21e5bef6e211d6","sha512":"7d88b22f4ad782e797c0002efae7410680852a9c12d0fdecae45d48d91be3d88a4653b21d76c9bbbc5c96b00557c7fa0672ae2f450e8de0ba963a19487c720ce","ssdeep":"3072:/NRJVgWI3WUbOmZPbOm3FttKCQh9/JVW9i9K:uKoPKqFu9RVUi9","ssdeep_chunks":["3072:/NRJVgW","3072:NRJVgWI","3072:RJVgWI3","3072:JVgWI3W","3072:VgWI3WU","3072:gWI3WUb","3072:WI3WUbO","3072:I3WUbOm","3072:3WUbOmZ","3072:WUbOmZP","3072:UbOmZPb","3072:bOmZPbO","3072:OmZPbOm","3072:mZPbOm3","3072:ZPbOm3F","3072:PbOm3Ft","3072:bOm3Ftt","3072:Om3FttK","3072:m3FttKC","3072:3FttKCQ","3072:FttKCQh","3072:ttKCQh9","3072:tKCQh9/","3072:KCQh9/J","3072:CQh9/JV","3072:Qh9/JVW","3072:h9/JVW9","3072:9/JVW9i","3072:/JVW9i9","3072:JVW9i9K","6144:/NRJVgW","6144:NRJVgWI","6144:RJVgWI3","6144:JVgWI3W","6144:VgWI3WU","6144:gWI3WUb","6144:WI3WUbO","6144:I3WUbOm","6144:3WUbOmZ","6144:WUbOmZP","6144:UbOmZPb","6144:bOmZPbO","6144:OmZPbOm","6144:mZPbOm3","6144:ZPbOm3F","6144:PbOm3Ft","6144:bOm3Ftt","6144:Om3FttK","6144:m3FttKC","6144:3FttKCQ","6144:FttKCQh","6144:ttKCQh9","6144:tKCQh9/","6144:KCQh9/J","6144:CQh9/JV","6144:Qh9/JVW","6144:h9/JVW9","6144:9/JVW9i","6144:/JVW9i9","6144:JVW9i9K","3072:uKoPKqF","3072:KoPKqFu","3072:oPKqFu9","3072:PKqFu9R","3072:KqFu9RV","3072:qFu9RVU","3072:Fu9RVUi","3072:u9RVUi9"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"144922c0136c53b033caff409a9be3bbf007c5b8"},"file_info":{"file_name":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":172600,"entropy":5.92,"compile_timestamp":"2010-05-25T22:12:02","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791936020000,"last_seen":1791936020000,"last_multi_scan":1791936020000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":3,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":164308,"raw_size":164352},{"name":".rsrc","virtual_address":"0x2c000","virtual_size":1472,"raw_size":1536},{"name":".reloc","virtual_address":"0x2e000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":50},"sandbox_signatures":{"informative_count":129,"suspicious_count":9,"malicious_count":1,"total":139},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Contains pe file in dotnet resource"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Sample/File contains another embedded binary"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.00300000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26 has big resource with name: \"HPHASUtil.HPHelpUpdater.exe\" size: \"74808\" and abnormal entropy:\"6.581805623673715\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"dw20.exe\" [UID: 00000000-00004376]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004020-00000C2C-296713166\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00004020-00000C2C-296938192\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00004020-00000C2C-302141325\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00004020-00000C2C-302142170\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor byte ptr [edi]\n ch in Stream UID: 00000000-00004020-16641-4-00ADA10C\n Assembly shows XOR instruction xor al\n 52h in Stream UID: 00000000-00004020-16641-4-00ADA10C\n Assembly shows XOR instruction xor cl\n byte ptr [ebx-04h] in Stream UID: 00000000-00004020-16641-4-00ADA10C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 154878; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 170962; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"\n Observed dotnet function \"GetDirectories\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"BIOSVersion\" (Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.04280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004020-00000C2C-295161571\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004020-00000C2C-294386470\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004020-00000C2C-294387214\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004020-00000C2C-308152692\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004020-00000C2C-301970123\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004020)\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004020)\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"IsWow64Process\" with parameter \"4020\" - (UID: 00000000-00004020)\n \"dw20.exe\" called \"IsWow64Process\" with parameter \"4376\" - (UID: 00000000-00004376)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00004020)\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from MS_SystemInformation\" (Indicator: \"select * from \"; File: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found string \"Select * from MS_SystemInformation\" (Indicator: \"select * from \"; Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.020F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"4674294,2116,3024,,RtlGetVersion,NTDLL.dll,\"01:01:10.922\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" queried token user identity (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"dw20.exe\" was created by \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004020)\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"CreateProcessW\" with parameter \"dw20.exe -x -s 1356\" - (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Win7\\HPHelpUpdater\\obj\\Release\\HPHelpUpdater.pdb\"\n \"C:\\VSPROJECTS\\HPHAS\\HPHASUtil\\obj\\Release\\HPHASUtil.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from MS_SystemInformation\" (Source: 4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26, Indicator: \"select * from ms_systeminformation\")\n \"Select * from MS_SystemInformation\" (Source: 00000000-00004020.00000001.130727.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.020F0000.00000004.mdmp, Indicator: \"select * from ms_systeminformation\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.set_StartInfo\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"\n Observed function \"Process.Start\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe created mutex with name \"Global\\CLR_PerfMon_WrapMutex\"\n Process dw20.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\286b7497-c763-11f1-8ae2-00505691a7dd\"\n Process dw20.exe created mutex with name \"Global\\286b7497-c763-11f1-8ae2-00505691a7dd\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKey\" in \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00004020.00000001.130727.020F0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77430000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6A390000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 64310000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 750D0000\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74C90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77850000\n \"dw20.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77850000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f4fe76@RPCRT4.dll\"\n \"1800190068e8696d@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8696d@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f696d@ntdll.dll\"\n \"100011000e03b86b@ADVAPI32.dll\"\n \"0d000e002203b86b@ADVAPI32.dll\"\n \"0d000e00fe02b86b@ADVAPI32.dll\"\n \"0b000c00cc02b86b@ADVAPI32.dll\"\n \"10001100da02b86b@ADVAPI32.dll\"\n \"150016002073316c@ADVAPI32.dll\"\n \"0e000f00e473316c@ADVAPI32.dll\"\n \"0e000f005074316c@ADVAPI32.dll\"\n \"11001200d47d316c@ADVAPI32.dll\"\n \"110012007c7e316c@ADVAPI32.dll\"\n \"12001300cc7e316c@ADVAPI32.dll\"\n \"12001300387f316c@ADVAPI32.dll\"\n \"14001500dcb8316c@ADVAPI32.dll\"\n \"14001500f8b8316c@ADVAPI32.dll\"\n \"1400150014b9316c@ADVAPI32.dll\"\n \"1700180030b9316c@ADVAPI32.dll\"\n \"0d000e004cb9316c@ADVAPI32.dll\"\n \"110012005cb9316c@ADVAPI32.dll\"\n \"1100120074b9316c@ADVAPI32.dll\"\n \"0f001000e4ba316c@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\" was detected as \".NET\" and name: \"Library\"\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$30","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$31","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\\\dw20.exe\" [Source: 00000000-00004020-00000C47-38394723052]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"dw20.exe\" (UID: 00000000-00004376) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"dw20.exe\" (UID: 00000000-00004376) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"dw20.exe\" with commandline \"-x -s 1356\" (UID: 00000000-00004376)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"dw20.exe\" with commandline \"-x -s 1356\" (UID: 00000000-00004376)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$33","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"dw20.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"60E31627FDA0A46932B0E5948949F2A5\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\60E31627FDA0A46932B0E5948949F2A5]- [targetUID: 00000000-00004020]\n \"3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1]- [targetUID: 00000000-00004020]\n \"60E31627FDA0A46932B0E5948949F2A5\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\60E31627FDA0A46932B0E5948949F2A5]- [targetUID: 00000000-00004020]\n \"3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1]- [targetUID: 00000000-00004020]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config\"\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\60e31627fda0a46932b0e5948949f2a5\"\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3c3948be6e525b8a8cee9fac91c9e392_5beb6c6453db87d996bdbc5d90d34ae1\"\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3c3948be6e525b8a8cee9fac91c9e392_5beb6c6453db87d996bdbc5d90d34ae1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3a","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004020)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"3f6038\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"4285af8\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"429c2c0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"429c2c0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"\n \"$error\": \"2ee7\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3f6038\"\n \"lpReserved\": \"0\"}\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"4285af8\"\n \"lpReserved\": \"0\"}\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"429c2c0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004020.00000000.129949.00C00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00004020.00000000.129949.00300000.00000004.mdmp\n 00000000-00004020.00000001.130727.00300000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"8.0.0.0\"\n \"2.0.0.0\"\n \"9.0.0.0\"\n \"1.4.2.3\"\n \"1.0.0.0\"\n Potential IP \"2.0.0.0\" found in string \"mscorlib,2.0.0.0,,b77a5c561934e089,x86\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.15\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.4\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n \"192.168.0.2\"\n \"2.5.29.21\"\n \"2.5.29.20\"\n Potential IP \"2.0.0.0\" found in string \"sion=2.0.0.0, Culture=neutral, Publ\"\n Potential IP \"2.0.0.0\" found in string \"rsion=2.0.0.0, Culture=neutral, Pub\"\n Potential IP \"2.0.0.0\" found in string \"ersion=2.0.0.0, Culture=neutral, Public\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.6\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004020.00000001.130727.04280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.verisign.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLED92BC24346D44B01A8223C6CD8FD]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE71A41988C6254F5FAB385710B124]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004020.00000001.130727.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"4674294,2116,3024,,RtlGetVersion,NTDLL.dll,\"01:01:10.922\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"ariant=\"System.Data.OleDb\" description=\" (Indicator: \"System.Data.OleDb\"; Source: \"00000000-00004020.00000001.130727.04280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"dw20.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"4020\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; File: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")\n Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"7119522,3380,3185,,GetAdaptersAddresses,\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00004020.00000001.130727.04280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"\" (Indicator: \"password\"; File: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found string \"\" (Indicator: \"password\"; Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004020.00000000.129949.00300000.00000004.mdmp, 00000000-00004020.00000001.130727.00300000.00000004.mdmp\")\n Found string \"2\\drivers\\SandboxFilter.sys\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00004020.00000000.129949.00C00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"60E31627FDA0A46932B0E5948949F2A5\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\60E31627FDA0A46932B0E5948949F2A5]- [targetUID: 00000000-00004020]\n Dropped file: \"3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1]- [targetUID: 00000000-00004020]\n Dropped file: \"60E31627FDA0A46932B0E5948949F2A5\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\60E31627FDA0A46932B0E5948949F2A5]- [targetUID: 00000000-00004020]\n Dropped file: \"3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1]- [targetUID: 00000000-00004020]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Delete\" (Source: 4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26, API is part of module: WMINET_UTILS.DLL)\n Found string \"Sleep\" (Source: 4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26, API is part of module: KERNELBASE.DLL)\n Found string \"GetCurrentProcess\" (Source: 4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" at 00000000-00004020-00000105-3130189","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" launched with commandline \"-x -s 1356\" (UID: 00000000-00004376)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 4020)\n \"dw20.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 4376)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe queries ProcessDebugPort (UID: 4020)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in File: \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26\")\n Found string \"\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004020.00000001.130727.00AB2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains pe file in dotnet resource","description":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26 has PE file in resource with name: \"HPHASUtil.HPHelpUpdater.exe\" and filetype: \"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 4 sections\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-109","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Sample/File contains another embedded binary","description":"Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/798a76ae-6c81-405e-bff8-ab5414e80c35/sample.bin at offset 81786","origin":"Binary File","mitre_attack_id":"T1027.009","relevance":3,"id":"binary-64","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 1392)\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 1392)\n \"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 1392)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]}],"intel_graph":{"map":{"File:4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26":{"type":"File","value":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d":{"type":"File","value":"64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d"},"File:bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128":{"type":"File","value":"bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128"},"File:f54234864405c974bd0cb79187dd85d534e690916ca427acff564490bfd79075":{"type":"File","value":"f54234864405c974bd0cb79187dd85d534e690916ca427acff564490bfd79075","filetype":"data (from pe_extract_certificates)","filetype_short":"DATA","mime_type":"application/vnd.ms-cab-compressed"}},"chains":[{"id":"1559717466928527273","root":"File:4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1559717466444063200","root":"File:4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","to_key":"File:f54234864405c974bd0cb79187dd85d534e690916ca427acff564490bfd79075"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","edges":[{"edge_kind":"extracted","from_key":"File:4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","to_key":"File:f54234864405c974bd0cb79187dd85d534e690916ca427acff564490bfd79075"},{"edge_kind":"extracted","from_key":"File:4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","to_key":"File:bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128"},{"edge_kind":"extracted","from_key":"File:4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","to_key":"File:64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":104,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6acec6135c1ba373310ebee9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","analysis_start_time":"2026-10-14T00:00:20+00:00","indicators_count":{"informative":129,"suspicious":17,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}],"processes":[{"pid":4020,"ppid":0,"name":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe","command_line":"","sha256":"4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26","normalized_path":"C:\\4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26.exe","uid":"00000000-00004020","icon":"$41"},{"pid":4376,"ppid":4020,"name":"dw20.exe","command_line":"-x -s 1356","sha256":"728f9cfd55a2d64816805bce935e28034755374e0163a3415f33ad807fbc91cc","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe","parent_uid":"00000000-00004020","uid":"00000000-00004376"}],"all_imported_dlls":["api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","shlwapi.dll","profapi.dll","msasn1.dll","rsaenh.dll","ncrypt.dll","wshqos.dll","sechost.dll","vcruntime140.dll","api-ms-win-crt-heap-l1-1-0.dll","mscorlib.ni.dll","mscorsec.dll","credssp.dll","wship6.dll","cfgmgr32.dll","mscoree.dll","api-ms-win-crt-runtime-l1-1-0.dll","comctl32.dll","SensApi.dll","dhcpcsvc.dll","dnsapi.dll","Culture.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","imm32.dll","IPHLPAPI.DLL","System.Management.ni.dll","ntdsapi.dll","msvcrt.dll","VxSSL32.dll","nsi.dll","ole32.dll","crypt32.dll","mscorjit.dll","NapiNSP.dll","api-ms-win-core-file-l1-2-0.dll","wbemsvc.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","wintrust.dll","mswsock.dll","rpcrt4.dll","api-ms-win-crt-utility-l1-1-0.dll","Wldap32.dll","winnsi.dll","WMINet_Utils.dll","clbcatq.dll","wbemprox.dll","fastprox.dll","advapi32.dll","oleaut32.dll","riched20.dll","userenv.dll","gpapi.dll","msctf.dll","version.dll","imagehlp.dll","sspicli.dll","rasadhlp.dll","FWPUCLNT.DLL","wmiutils.dll","wbemcomn2.dll","gdi32.dll","mscoreei.dll","apphelp.dll","mscorrc.dll","wer.dll","user32.dll","lpk.dll","mscorwks.dll","shell32.dll","cryptsp.dll","winrnr.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","msvcr80.dll","cryptbase.dll","winhttp.dll","webio.dll","nlaapi.dll","pnrpnsp.dll","KernelBase.dll","ws2_32.dll","msvcp140.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-environment-l1-1-0.dll","cryptnet.dll","usp10.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","bcrypt.dll","WSHTCPIP.DLL","dhcpcsvc6.dll","diasymreader.dll","psapi.dll","kernel32.dll","fltLib.dll","ucrtbase.dll","api-ms-win-core-localization-l1-2-0.dll","ntdll.dll","bcryptprimitives.dll","System.ni.dll","RpcRtRemote.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"f54234864405c974bd0cb79187dd85d534e690916ca427acff564490bfd79075","sha256":"f54234864405c974bd0cb79187dd85d534e690916ca427acff564490bfd79075","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1","sha256":"bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"name":"60E31627FDA0A46932B0E5948949F2A5","sha256":"64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\60E31627FDA0A46932B0E5948949F2A5","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\60E31627FDA0A46932B0E5948949F2A5","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3C3948BE6E525B8A8CEE9FAC91C9E392_5BEB6C6453DB87D996BDBC5D90D34AE1","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\286b7497-c763-11f1-8ae2-00505691a7dd","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]},{"name":"Global\\286b7497-c763-11f1-8ae2-00505691a7dd","sources":[{"report_type":"sandbox","report_id":"6acec6135c1ba373310ebee9"}]}]}},"report_ids":{"sandbox_job_ids":["6acec6135c1ba373310ebee9"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 4e3f99b17e12… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 4e3f99b17e12…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26"}],["$","meta","4",{"property":"og:title","content":"Sample 4e3f99b17e12… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 4e3f99b17e12…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4e3f99b17e127b9354206e7ddd529eaf33944d456e7412e097ef2891ae1dfb26"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 4e3f99b17e12… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 4e3f99b17e12…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]