Telegram: Contact @memve4erin

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 70:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 52e7510e97f5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 52e7510e97f5…. Malware family: Trojan.Generic. Threat score 100/100. 13/23 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708"],"about":{"@type":"SoftwareApplication","name":"543e80dbd2fa8ddf8cebccc1099b4609.exe","applicationCategory":["compressed","7zip"],"identifier":"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":23},"behavioralIndicators":{"malicious":7,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2af9,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")28:T61c,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477344'}" (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477264'}" (UID: 00000000-00005636) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917784'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917560'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917816'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917624'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917800'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917608'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917576'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917832'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2917592'}" (UID: 00000000-00006048) "Mind.pif" called "LoadResource with parameter {'hModule': '1845886976', 'hResInfo': '1846063624'}" (UID: 00000000-00006048)29:Ta17,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000816.00000330.104040089.00850000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000816.00000330.104040089.00850000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00000816.00000330.104040089.00850000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "00000816.00000330.104040089.00850000.wprm") Found string "?ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/OID." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000816.00000330.104040089.00850000.wprm") Found string "?ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/OID." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000816.00000330.104040089.00850000.wprm") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00000816.00000330.104040089.00850000.wprm") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00000816.00000330.104040089.00850000.wprm") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "00000816.00000330.104040089.00850000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000816.00000330.104040089.00850000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000816.00000330.104040089.00850000.wprm") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00000816.00000330.104040089.00850000.wprm")2a:Td1f,Found reference to "CMS RC2 Key Wrap" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]" (Indicator: "SHA512"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA384_RSA_PKCS_PSS" (Indicator: "SHA384"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA512_RSA_PKCS_PSS" (Indicator: "SHA512"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA384_RSA_PKCS" (Indicator: "SHA384"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA512_RSA_PKCS" (Indicator: "SHA512"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA384_KEY_DERIVATION" (Indicator: "SHA384"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA512_KEY_DERIVATION" (Indicator: "SHA512"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_RC2_KEY_GEN" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_RC2_MAC_GENERAL" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_RIPEMD128_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA256_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_MD5_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA384_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA384_HMAC_GENERAL" (Indicator: "SHA384"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA224_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_MD2_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA512_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA512_HMAC_GENERAL" (Indicator: "SHA512"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_SHA_1_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_RIPEMD160_HMAC_GENERAL" (Indicator: "HMAC"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKK_HKDF" (Indicator: "HKDF"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_RC2_CBC_PAD" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_PBE_SHA1_RC2_128_CBC" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_RC2_CBC" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "CKM_PBE_SHA1_RC2_40_CBC" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to "RC2-CBC" (Indicator: "RC2"; File: "00000816.00000330.104040089.00850000.wprm")2b:Tcc0,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELL\OPEN\COMMAND") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\.EXE") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKCU\.EXE\OPENWITHPROGIDS") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.EXE\OPENWITHPROGIDS") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\OPENWITHPROGIDS") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\OPENWITHPROGIDS") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\")2c:T6d7,Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; File: "00000816.00000330.104040089.00850000.wprm") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "00000816.00000330.104040089.00850000.wprm") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; File: "00000816.00000330.104040089.00850000.wprm") Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; File: "00000816.00000330.104040089.00850000.wprm") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "00000816.00000330.104040089.00850000.wprm") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "00000816.00000330.104040089.00850000.wprm") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "00000816.00000330.104040089.00850000.wprm") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp")2d:T5b5,Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00000816-00000C2C-276778788") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00000816-00000C2C-276778858") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00000816-00000C2C-276778928") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00000816-00000C2C-276779057") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00000816-00000C2C-276779123") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00000816-00000C2C-284746107") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp")2e:T10bc,"Mind.pif" called "BCryptImportKey" with parameters {"hAlgorithm": "11cfb20" "pszBlobType": "OpaqueKeyBlob" "phKey": "90371f01" "pbKeyObject": "Prov" "cbKeyObject": "610" "pbInput": "300200004b53534d0200010005000000100000008000000010000000035f114b9d0122ec82b5642ef8680c453910795d9d902d631c6d480bc05fe0090bdd9cda035f114b9d0122ec82b5642ef8680c4547a17f0adaa05de6581539c8a07d358dba3722ea60977f0c388246c498ff7349a8b819acc82f66a0f0ad20646852532da055c1e9687aa74998d7872df085d400271da2654f67052cd7b082012735560191acdea9decbdb85097b59842e4e0f85feda49982011921d296acb990724c41c48c6d55d68d7474041bd8cd9469948c5bd947307d543344794feb89ed267f05b0e184ab2db5b7ef54fa5c66b9dc2363079b80d91c731f7e4eaf35e0bc54cdb4c3b8caa1bbe89fa752dc2a9ef2fbf854740e8065b8505506e934b539a027d2ca8e0703be1c5ed5635164e03f491367f3225d7414e259d6dd4d3a355c187787cc6a1cf61d2004a2c9af63e381554db2907804b600ea1854d48f674148fa2e51112b61fa44821ce2d4657f159c75491059d17fb126d97d1890e763f748103605c5a035f114b9d0122ec82b5642ef8680c450000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000005e98065afe385c100000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "Mind.pif" called "BCryptImportKey" with parameters {"hAlgorithm": "11cfb20" "pszBlobType": "OpaqueKeyBlob" "phKey": "503a1f01" "pbKeyObject": "620200005255555520fb1c01703a1f0100000000000000000000000000000000300200004b53534d0200010005000000100000008000000010000000cc5e830280ee5ed3fe6e8d12fb9447821de61466d01a3910795d9d902d631c6d480bc05fcc5e830280ee5ed3fe6e8d12fb944782effe900d6f10cede917e43cc6aea044e6a0cbf0f051c71d19462321dfe883653aa0952b4af1523653b771178c5ff272bb4c5a3121bd0807720a7910fe558b624ce8b95cbd55b15bcf5fc84b310a43297a7a81d0172f308bd870f8c0e97abbe998506f389f7f5fb3470fa773ae751c9a3d4dbf91d232e022953d47513b485bcb058be1e907b901cb9284469aa9cc1d51a16bdbc4e6d2da0f74569c95dd9a81c4789581fa6393fc28a4f2b4b8077c601228c586c53b067dd2c7614890a38ed4aa22b8db4eb3c3fb17fc67354264ef9c3a8ecc0704f17b20594fa4ce559888a978ef06f9d19fb7275dbedfee0cd72c672d790e21cae0b1de8c2168c95169f38921a612613119bfff46c1d917dd489b4070ce34181f5fad9e77d866e89b894257ad8aa43d6b3199866887cb76ec5124bf360cc5e830280ee5ed3fe6e8d12fb9447820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000296c90ce197826c100000000000000000000000000000000000000000000000000000000000000000000" "cbKeyObject": "610" "pbInput": "300200004b53534d0200010005000000100000008000000010000000cc5e830280ee5ed3fe6e8d12fb9447821de61466d01a3910795d9d902d631c6d480bc05fcc5e830280ee5ed3fe6e8d12fb944782effe900d6f10cede917e43cc6aea044e6a0cbf0f051c71d19462321dfe883653aa0952b4af1523653b771178c5ff272bb4c5a3121bd0807720a7910fe558b624ce8b95cbd55b15bcf5fc84b310a43297a7a81d0172f308bd870f8c0e97abbe998506f389f7f5fb3470fa773ae751c9a3d4dbf91d232e022953d47513b485bcb058be1e907b901cb9284469aa9cc1d51a16bdbc4e6d2da0f74569c95dd9a81c4789581fa6393fc28a4f2b4b8077c601228c586c53b067dd2c7614890a38ed4aa22b8db4eb3c3fb17fc67354264ef9c3a8ecc0704f17b20594fa4ce559888a978ef06f9d19fb7275dbedfee0cd72c672d790e21cae0b1de8c2168c95169f38921a612613119bfff46c1d917dd489b4070ce34181f5fad9e77d866e89b894257ad8aa43d6b3199866887cb76ec5124bf360cc5e830280ee5ed3fe6e8d12fb9447820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000296c90ce197826c100000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "Mind.pif" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "11d0990" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b8782201" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "Mind.pif" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "11d0990" "pszBlobType": "RSAPUBLICBLOB" "phKey": "18792201" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}2f:T1390,Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00000816-7279-13-0086A110 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-13-0086A110 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00000816-7279-36-008617D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-138-0086A2FF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000816-7279-138-0086A2FF Assembly shows XOR instruction xor al E1h in Stream UID: 00000000-00000816-7279-221-00869050 Assembly shows XOR instruction xor al cl in Stream UID: 00000000-00000816-7279-300-00852308 Assembly shows XOR instruction xor eax dword ptr [ecx] in Stream UID: 00000000-00000816-7279-400-00D6D030 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000816-7279-402-00D6C6E0 Assembly shows XOR instruction xor ebx dword ptr [ecx] in Stream UID: 00000000-00000816-7279-402-00D6C6E0 Assembly shows XOR instruction xor esi dword ptr [eax+ebx] in Stream UID: 00000000-00000816-7279-406-00D6CFE0 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00000816-7279-408-00D76760 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-408-00D76760 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00000816-7279-419-00D706AF Assembly shows XOR instruction xor edi 756E6547h in Stream UID: 00000000-00000816-7279-430-00D76554 Assembly shows XOR instruction xor eax 49656E69h in Stream UID: 00000000-00000816-7279-430-00D76554 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00000816-7279-430-00D76554 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00000816-7279-438-00D76A45 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00000816-7279-438-00D76A45 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00000816-7279-438-00D76A45 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00000816-7279-438-00D76A45 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00000816-7279-438-00D76A45 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-478-00D75BAD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000816-7279-478-00D75BAD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-485-00D70B12 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000816-7279-485-00D70B12 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-487-00D70B9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000816-7279-487-00D70B9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-493-00D74E3A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000816-7279-493-00D74E3A Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00000816-7279-578-00D6B910 Assembly shows XOR instruction xor dh byte ptr [eax] in Stream UID: 00000000-00000816-7279-604-00D6C5A0 Assembly shows XOR instruction xor byte ptr [eax] dh in Stream UID: 00000000-00000816-7279-604-00D6C5A0 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00000816-7279-606-00D6D280 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-606-00D6D280 Assembly shows XOR instruction xor dword ptr [eax] esi in Stream UID: 00000000-00000816-7279-607-00D6C4D0 Assembly shows XOR instruction xor byte ptr [eax] dh in Stream UID: 00000000-00000816-7279-607-00D6C4D0 Assembly shows XOR instruction xor edi 756E6547h in Stream UID: 00000000-00000816-7279-900-00D571D1 Assembly shows XOR instruction xor eax 49656E69h in Stream UID: 00000000-00000816-7279-900-00D571D1 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00000816-7279-900-00D571D1 Assembly shows XOR instruction xor eax dword ptr [10039014h] in Stream UID: 00000000-00000816-7279-908-00D56E0C Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00000816-7279-916-00D56C1E Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00000816-7279-916-00D56C1E Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00000816-7279-916-00D56C1E Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00000816-7279-916-00D56C1E Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00000816-7279-916-00D56C1E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000816-7279-917-00D56730 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000816-7279-917-00D56730 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000816-7279-920-00D5665030:T52d,Found reference to API "CryptCATAdminReleaseContext" (Indicator: "CryptCATAdminReleaseContext"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "CryptCATAdminAcquireContext" (Indicator: "CryptCATAdminAcquireContext"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "CryptCATAdminEnumCatalogFromHash" (Indicator: "CryptCATAdminEnumCatalogFromHash"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "CryptCATAdminCalcHashFromFileHandle" (Indicator: "CryptCATAdminCalcHashFromFileHandle"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "CryptCATAdminAcquireContext2" (Indicator: "CryptCATAdminAcquireContext"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "CryptCATAdminCalcHashFromFileHandle2" (Indicator: "CryptCATAdminCalcHashFromFileHandle"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "00000816.00000330.104040089.00850000.wprm")31:T591,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Decrypted SSL network traffic Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly]32:T5e2,file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "Controversial") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005636-00000C2C-161617257") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005636-00000C2C-161617465") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005636-00000C2C-161617805") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp")33:T92e,Found reference to API "__crtGetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00000816.00000001.82185.01110000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00000816.00000001.82185.01110000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00000816.00000001.82185.01110000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003912.00000000.79834.00731000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp")34:T52e,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp")35:T24af,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005a00a0f5120095e1e476cfe60900feffffffff2be8769a2ae87644114c6b0000000000000000acf312002c32007748f41200c83a3575bcf41200d58c2d75f8f412008cf4120042a42b75a8023575ccf41200d2f42b75080000006ef52b7544f52b755b24d1f502000000341a496b000013005b51496b020000000000000044114c6b8008620044114c6b000000008008620010f51200086de8761881f07601000000000000000000496b341a496b000013005b51496b84275a0080275a00e0f4120020f51200a0f5120091e14b6b9b119d9e24f51200c89fe87644114c6b00000000 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000340039003500310064003200320066003800620039003400640038003700380035003500620063006200330064006400340064003600650036003700300038002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2be876e70ef376d8ebfb75ac01620000006200000000000000000016008e00e40400000000000000000000000000000000000017008900e404000000000000000000001870620000000000200000000000000000000000e8eb6500086d6200286e6200400c6200d071620000000000b4f312000000000034f51200 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600080bd1f500db12006d826d755c0a680004010000 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005a00c7e814739a1825f5e0bd5a0070a75a0078a75a0078a75a00d8f212000000000030f5120022c71f730e5f1786feffffffe0bd5a0078a75a00000000002cf312007359487070a75a0008000000b8a75a000000000064f3120031c5147394a75a00c7e81473fa1825f57359487070a75a0078a75a0078a75a0038f312000000000030f5120022c71f7329c419735441444932150000d8bd5a00000000008cf3120100000000d8bd5a00bdc5147309000000d8bd5a00dcf3120024831d73530000003215000054414449010000000000000000000000b9831d73911500008d150000 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e4ef0170e4ef0138e6ef0192e0a871f9899e85feffffffb8e5ef0116bca771aca744e002000000ece4ef01b8e5ef0120bca771060000000000ed69010000002fbca7712a00000006000000aca744e002000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e5ef01000000008e00000044e6ef01feffffffcce5ef01cf00e976d600e976131f0e778e0000004700000044e6ef0100000000a0e5ef010000000008e6ef0195e1e476c7fc0900feffffffd600e9762f7bee740100000047009c06167bee74140f2bf4 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000d8a86b00aceeef010464e87638016200e063e87673140e770000000000006200e0a86b006dd10976b3072bf46caede75000000000000000018020000e1780099c40062000100000000006200500162000c000000e0a86b000000000002000000180000002000000088eeef010000000000000000030000004ceeef013c6ee87600000000000000000000000050f36500c075117650f3650000000000c075117668eeef0179da09760000000002000000c0eeef01ff2be8762b140e777400000004026200000062002f00020101000000200020006caede7500000101ccedef01 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005664) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000310018000000aa0000000000000000000000b0eb3400986b3100006d3100500e3700b0773100610073009cce2a0069007300a4db2a00500e3700e9e9e876500e370000000000aa000000c8cf2a0000d42a0000000000000000000000000000000000000000000000000000000000000000001c5ce77660d8ee74ffffffff1700000078cf2a00240000000300000068d42a0094d92a0000d42a0086000000a4cf2a0096ede876720e3700a06abe7486000000c8cf2a0000d42a000000000086008800a06abe74c8cf2a00916cbe74720e3700a06abe74a06abe7438d42a0002020000 (UID: 00000000-00005664) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005664) "tasklist.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005668)36:T7ba,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebfb75400c62000080fd7f9a5ce97600f0fd7ff8f412004480fd7f00000000400000003f0000001d0000000080fd7fecf41200c15ce9766082f0761d0000000080fd7f9a5ce97600f0fd7f10f512005789e8768083f0761317ef74d8ebfb75 (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "Mind.pif" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000816) "Mind.pif" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000816) "Mind.pif" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebfb7590f1260100d0fd7f9a5ce97600f0fa7fd4c9081344d0fd7f00000000400000003f0000002e00000000d0fd7fc8c90813c15ce9766082f0762e00000000d0fd7f9a5ce97600f0fa7fecc908135789e8768083f0761317ef74d8ebfb75 (UID: 00000000-00000816)37:Tbf2,Found string "Select * From AntiVirusProduct" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "Select * From Win32_OperatingSystem" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "SELECT * FROM %Q.%Q" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "SELECT 2 * total(1 + leaves_end_block - start_block) FROM (SELECT * FROM %Q.'%q_segdir' WHERE level = ? ORDER BY idx ASC LIMIT ? )" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "SELECT * FROM "%w"."%w_rowid" WHERE rowid=?1" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "SELECT * FROM "%w"."%w" WHERE NOT EXISTS ( SELECT 1 FROM "%w"."%w" WHERE %s)" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "SELECT * FROM %Q.'%q_rowid'" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "SELECT * FROM "%w"."%w", "%w"."%w" WHERE %s AND (%z)" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "CREATE TEMPORARY TABLE %s AS SELECT * FROM %s" (Indicator: "select * from "; File: "00000816.00000330.104040089.00850000.wprm") Found string "Select * From AntiVirusProduct" (Indicator: "select * from "; Source: "00000000-00000816.00000001.82185.01110000.00000004.mdmp") Found string "SELECT * FROM %Q.%Q" (Indicator: "select * from "; Source: "00000000-00000816.00000001.82185.61EB7000.00000002.mdmp") Found string "SELECT 2 * total(1 + leaves_end_block - start_block) FROM (SELECT * FROM %Q.'%q_segdir' WHERE level = ? ORDER BY idx ASC LIMIT ? )" (Indicator: "select * from "; Source: "00000000-00000816.00000001.82185.61EB7000.00000002.mdmp") Found string "SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)" (Indicator: "select * from "; Source: "00000000-00000816.00000001.82185.61EB7000.00000002.mdmp") Found string "SELECT * FROM "%w"."%w_rowid" WHERE rowid=?1" (Indicator: "select * from "; Source: "00000000-00000816.00000001.82185.61EB7000.00000002.mdmp") Found string "SELECT * FROM "%w"."%w" WHERE NOT EXISTS ( SELECT 1 FROM "%w"."%w" WHERE %s)" (Indicator: "select * from "; Source: "00000000-00000816.00000001.82185.61EB7000.00000002.mdmp") Found string "SELECT * FROM %Q.'%q_rowid'" (Indicator: "select * from "; Source: "00000000-00000816.00000001.82185.61EB7000.00000002.mdmp") Found string "SELECT * FROM "%w"."%w", "%w"."%w" WHERE %s AND (%z)" (Indicator: "select * from "; Source: "00000000-00000816.00000001.82185.61EB7000.00000002.mdmp")38:T58e,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Mind.pif" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Mind.pif" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")39:Tb5c,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "__imp__GetSystemTimeAsFileTime@4" (Indicator: "GetSystemTimeAsFileTime"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "_GetSystemTimeAsFileTime@4" (Indicator: "GetSystemTimeAsFileTime"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "__imp__SystemTimeToFileTime@8" (Indicator: "SystemTimeToFileTime"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "_SystemTimeToFileTime@8" (Indicator: "SystemTimeToFileTime"; File: "00000816.00000330.104040089.00850000.wprm") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.61EB7000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.61EB7000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.61EB7000.00000002.mdmp, 00000000-00000816.00000001.82185.61ED0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.61EB7000.00000002.mdmp, 00000000-00000816.00000001.82185.61ED0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003912.00000000.79834.00731000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp")3a:T718,"Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Mind.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3b:T6cb,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME")3c:T46c,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.61EB7000.00000002.mdmp, 00000000-00000816.00000001.82185.61ED0000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000000.81068.01100000.00000004.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.01100000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003912.00000000.79834.00731000.00000020.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp")3d:T559,"Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Mind.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Mind.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3e:T7de,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005636) "Mind.pif" called "CreateDirectoryA" with parameter C:\\ProgramData\\AAAAECGHCBGC (UID: 00000000-00000816) "Mind.pif" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00000816) "Mind.pif" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00000816) "Mind.pif" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00000816) "Mind.pif" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00000816) "Mind.pif" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00000816) "Mind.pif" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00000816) "Mind.pif" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00000816)3f:T56b,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /k copy Secretariat Secretariat.cmd & Secretariat.cmd & exit" - (UID: 00000000-00005636) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00005664) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "wrsa.exe opssvc.exe"" - (UID: 00000000-00005664) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"" - (UID: 00000000-00005664) "cmd.exe" called "CreateProcessW" with parameter "cmd /c md 150746" - (UID: 00000000-00005664) "cmd.exe" called "CreateProcessW" with parameter "findstr /V "reachedindicatingfindlawfu" Cologne" - (UID: 00000000-00005664) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b Abroad 150746\e" - (UID: 00000000-00005664) "cmd.exe" called "CreateProcessW" with parameter "150746\Mind.pif 150746\e" - (UID: 00000000-00005664) "cmd.exe" called "CreateProcessW" with parameter "timeout 5" - (UID: 00000000-00005664) "Mind.pif" called "CreateProcessW" with parameter "%TEMP%\150746\Mind.pif" - (UID: 00000000-00006048) "Mind.pif" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c timeout /t 10 & del /f /q "%TEMP%\150746\Mind.pif" & rd /s /q "C:\Pr" - (UID: 00000000-00000816)40:T2d51,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IconCodecService.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005636) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005664) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005668) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00005668) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00005668) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005668) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005668) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005668) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005768) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005768) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00005768) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00005768) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005768) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005768) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005768) "Mind.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter %TEMP%\150746\e (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006048) "Mind.pif" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter OLEAUT32 (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00000816) "Mind.pif" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00000816)41:Te571,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter WICCreateImagingFactory_Proxy (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005636) "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005664) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005664) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005664) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005664) "cmd.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005664) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005664) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005664) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005668) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00005668) "findstr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005692) "findstr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005692) "findstr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005692) "findstr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005692) "findstr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006012) "findstr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006012) "findstr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006012) "findstr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006012) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005768) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00005768) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005920) "Mind.pif" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter RtlDecompressFragment (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter NtSetContextThread (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter NtResumeThread (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00006048) "Mind.pif" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00006048) "timeout.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006032) "timeout.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006032) "timeout.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006032) "timeout.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006032) "Mind.pif" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetSystemPowerStatus (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CloseWindow (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CharToOemW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter StrCmpCA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter StrStrA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter StrCmpCW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter PathMatchSpecA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SymMatchString (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EnumerateSecurityPackagesA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InitializeSecurityContextA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter QueryContextAttributesA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HTTPSCertificateTrust (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HTTPSFinalProv (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SealMessage (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter UnsealMessage (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetRngInterface (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToProxyStubCLSID (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToTLBPath (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FlushViewOfFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HeapCompact (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter UnlockFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter UnlockFileEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter __dllonexit (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _beginthreadex (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _endthreadex (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _errno (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _iob (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _lock (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter localtime (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter calloc (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter cosh (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter free (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter malloc (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter memmove (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter qsort (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter realloc (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter sinh (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter strcspn (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter strlen (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter _unlock (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter abort (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter acos (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter asin (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter atan (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter tan (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter tanh (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00000816) "Mind.pif" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00000816) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002380) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002380) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002380) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002380)42:T1a97,"SELECT target_path, tab_url from downloads" (Source: 7279-200-00858022, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 7279-202-00858A07, Indicator: "select service, encrypted_token from token_service") "Select * From AntiVirusProduct" (Source: 7279-249-008615CE, Indicator: "select * from antivirusproduct") "Select * From Win32_OperatingSystem" (Source: 7279-251-00861425, Indicator: "select * from win32_operatingsystem") "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "select*from"%w".%s where %s order by rowid") "SELECT tbl,idx,stat FROM %Q.sqlite_stat1" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "select tbl,idx,stat from %q.sqlite_stat1") "CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "create table x(type text,name text,tbl_name text,rootpage int,sql text)"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "select*from"%w".%s order by rowid"), "DELETE FROM %Q.sqlite_master WHERE name=%Q AND type='index'" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "delete from %q.sqlite_master where name=%q and type='index'"), "INSERT INTO %Q.sqlite_master VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "insert into %q.sqlite_master values('trigger',%q,%q,0,'create trigger %q')"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update %q.sqlite_master set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1) tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1) tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*'" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "SELECT*FROM"%w"" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "select*from"%w""), "SELECT * FROM %Q.%Q" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "select * from %q.%q"), "SELECT tbl ?2 stat FROM %Q.sqlite_stat1 WHERE tbl IS ?1 AND idx IS (CASE WHEN ?2=X'' THEN NULL ELSE ?2 END)" (Source: 00000816.00000330.104040089.00850000.wprm, Indicator: "select tbl ?2 stat from %q.sqlite_stat1 where tbl is ?1 and idx is (case when ?2=x'' then null else ?2 end)")43:T776,Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003912.00000000.79834.00731000.00000020.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00003912.00000000.79834.00731000.00000020.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp")44:T16bc,"Software\AutoIt v3\AutoIt" in Source: 00000000-00000816.00000000.81068.00290000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00000816.00000000.81068.00290000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00000816.00000000.81068.00290000.00000002.mdmp "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" in Source: 00000000-00000816.00000000.81068.01100000.00000004.mdmp "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000000.81068.01100000.00000004.mdmp "Software\\Microsoft\\Office\\13.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000000.81068.01100000.00000004.mdmp "Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000000.81068.01100000.00000004.mdmp "Software\\Microsoft\\Office\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000000.81068.01100000.00000004.mdmp "Software\\Microsoft\\Office\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000000.81068.01100000.00000004.mdmp " Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000000.81068.01100000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00000816.00000001.82185.00290000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00000816.00000001.82185.00290000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00000816.00000001.82185.00290000.00000002.mdmp "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" in Source: 00000000-00000816.00000001.82185.01100000.00000004.mdmp "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000001.82185.01100000.00000004.mdmp "Software\\Microsoft\\Office\\13.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000001.82185.01100000.00000004.mdmp "Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000001.82185.01100000.00000004.mdmp "Software\\Microsoft\\Office\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000001.82185.01100000.00000004.mdmp "Software\\Microsoft\\Office\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000001.82185.01100000.00000004.mdmp " Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676\\" in Source: 00000000-00000816.00000001.82185.01100000.00000004.mdmp "try|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet|" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|Software\Microsoft" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "y|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\Curren|" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000816.00000001.82185.01110000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003912.00000000.79834.00731000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005636.00000000.73763.00408000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005636.00000000.73763.0040A000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005636.00000001.74490.0040A000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005636.00000001.74490.0041E000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005636.00000001.74490.00620000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00006048.00000002.78350.00290000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00006048.00000002.78350.00290000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00006048.00000002.78350.00290000.00000002.mdmp45:T2cfc,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69e70000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "ADVAPI32.DLL" at base 76130000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ac0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73650000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74c30000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6b490000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75220000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 741a0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 741d0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73aa0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "CRYPTBASE.DLL" at base 74c30000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73900000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "OLE32.DLL" at base 75c80000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "KERNEL32.DLL" at base 76050000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "COMCTL32.DLL" at base 73c30000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "OLEAUT32.DLL" at base 75090000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "SETUPAPI.DLL" at base 75360000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "RPCRT4.DLL" at base 76fd0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "CLBCATQ.DLL" at base 75220000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "NTMARTA.DLL" at base 741a0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75200000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "PROFAPI.DLL" at base 74d40000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 6fbc0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "WINDOWSCODECS.DLL" at base 730f0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "SHELL32.DLL" at base 761e0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "PROPSYS.DLL" at base 73ac0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "APPHELP.DLL" at base 74be0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69ed0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74d60000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75de0000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "SECUR32.DLL" at base 74a60000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74f50000 "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 76130000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76050000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "tasklist.exe" loaded module "CLBCATQ.DLL" at base 75220000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76050000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6cfa0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 74ca0000 "tasklist.exe" loaded module "KERNEL32.DLL" at base 76050000 "tasklist.exe" loaded module "CRYPTSP.DLL" at base 74740000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744d0000 "tasklist.exe" loaded module "ADVAPI32.DLL" at base 76130000 "tasklist.exe" loaded module "CRYPTBASE.DLL" at base 74c30000 "tasklist.exe" loaded module "RPCRTREMOTE.DLL" at base 74cd0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d480000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d180000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6c820000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 76fd0000 "tasklist.exe" loaded module "OLEAUT32.DLL" at base 75090000 "findstr.exe" loaded module "KERNEL32.DLL" at base 76050000 "findstr.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69e70000 "tasklist.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75200000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73900000 "Mind.pif" loaded module "KERNEL32.DLL" at base 76050000 "Mind.pif" loaded module "DWMAPI.DLL" at base 73650000 "Mind.pif" loaded module "COMCTL32.DLL" at base 73c30000 "Mind.pif" loaded module "UXTHEME.DLL" at base 73900000 "Mind.pif" loaded module "IMM32.DLL" at base 75070000 "Mind.pif" loaded module "COMCTL32" at base 73c30000 "Mind.pif" loaded module "SHELL32.DLL" at base 761e0000 "Mind.pif" loaded module "OLE32.DLL" at base 75c80000 "Mind.pif" loaded module "PSAPI.DLL" at base 75680000 "Mind.pif" loaded module "MSVCRT.DLL" at base 752b0000 "Mind.pif" loaded module "GDIPLUS.DLL" at base 73670000 "Mind.pif" loaded module "BCRYPT.DLL" at base 74850000 "Mind.pif" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74d60000 "Mind.pif" loaded module "WININET.DLL" at base 75720000 "Mind.pif" loaded module "SHLWAPI.DLL" at base 756c0000 "Mind.pif" loaded module "RSTRTMGR.DLL" at base 69470000 "Mind.pif" loaded module "DBGHELP.DLL" at base 6e0b0000 "Mind.pif" loaded module "SECUR32.DLL" at base 74a60000 "Mind.pif" loaded module "ADVAPI32.DLL" at base 76130000 "Mind.pif" loaded module "PROFAPI.DLL" at base 74d40000 "Mind.pif" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6fe30000 "Mind.pif" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74ec0000 "Mind.pif" loaded module "WS2_32.DLL" at base 76f80000 "Mind.pif" loaded module "WINHTTP.DLL" at base 707a0000 "Mind.pif" loaded module "CRYPT32.DLL" at base 74d90000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74700000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 746f0000 "Mind.pif" loaded module "IPHLPAPI.DLL" at base 73090000 "Mind.pif" loaded module "USERENV.DLL" at base 74f30000 "Mind.pif" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75200000 "Mind.pif" loaded module "URLMON.DLL" at base 75de0000 "Mind.pif" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 71860000 "Mind.pif" loaded module "DNSAPI.DLL" at base 745c0000 "Mind.pif" loaded module "RPCRT4.DLL" at base 76fd0000 "Mind.pif" loaded module "OLEAUT32.DLL" at base 75090000 "Mind.pif" loaded module "CRYPTBASE.DLL" at base 74c30000 "Mind.pif" loaded module "CLBCATQ.DLL" at base 75220000 "Mind.pif" loaded module "DHCPCSVC6.DLL" at base 72fa0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6cb20000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74260000 "Mind.pif" loaded module "RASADHLP.DLL" at base 714c0000 "Mind.pif" loaded module "DHCPCSVC.DLL" at base 72ec0000 "Mind.pif" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75200000 "Mind.pif" loaded module "CRYPTSP.DLL" at base 74740000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744d0000 "Mind.pif" loaded module "RPCRTREMOTE.DLL" at base 74cd0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6c840000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 75090000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75720000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73000000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76f80000 "Mind.pif" loaded module "CREDSSP.DLL" at base 74400000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74540000 "Mind.pif" loaded module "NCRYPT.DLL" at base 74870000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74410000 "Mind.pif" loaded module "WINTRUST.DLL" at base 75040000 "Mind.pif" loaded module "GPAPI.DLL" at base 74310000 "Mind.pif" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75200000 "Mind.pif" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75200000 "Mind.pif" loaded module "USER32.DLL" at base 75500000 "Mind.pif" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76050000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6cfa0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d480000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d180000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6b090000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76130000 "Mind.pif" loaded module "SXS.DLL" at base 74c40000 "Mind.pif" loaded module "OLEAUT32" at base 75090000 "Mind.pif" loaded module "SETUPAPI.DLL" at base 75360000 "Mind.pif" loaded module "PROPSYS.DLL" at base 73ac0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ac0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 761e0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\ACTXPRXY.DLL" at base 6e1a0000 "Mind.pif" loaded module "APPHELP.DLL" at base 74be0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\NTSHRUI.DLL" at base 71b90000 "Mind.pif" loaded module "SRVCLI.DLL" at base 74930000 "Mind.pif" loaded module "CSCAPI.DLL" at base 6fd10000 "Mind.pif" loaded module "SLC.DLL" at base 730e0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\WPDSHEXT.DLL" at base 64910000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e030000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69ed0000 "Mind.pif" loaded module "NTMARTA.DLL" at base 741a0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75de0000 "Mind.pif" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74f50000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "Mind.pif" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 73a90000 "Mind.pif" loaded module "NETUTILS.DLL" at base 7394000046:T1c10,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "Mind.pif" touched "Portable Devices" (Path: "HKCU\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "Mind.pif" touched "Portable Media Devices" (Path: "HKCU\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") "Mind.pif" touched "Enhanced Storage Data Source" (Path: "HKCU\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SHELLFOLDER") "Mind.pif" touched "delegate folder that appears in Computer" (Path: "HKCU\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "Mind.pif" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "Mind.pif" touched "Search Gatherer Notification" (Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "Mind.pif" touched "WBEM Scripting DateTime" (Path: "HKCU\CLSID\{47DFBE54-CF76-11D3-B38F-00105A1F473A}\TREATAS") "Mind.pif" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "Mind.pif" touched "Namespace Walker" (Path: "HKCU\CLSID\{72EB61E0-8672-4303-9175-F2E4C68B2E7C}\TREATAS") "Mind.pif" touched "Shell extensions for sharing" (Path: "HKCU\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\TREATAS") "Mind.pif" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "Mind.pif" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "Mind.pif" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "Mind.pif" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "Mind.pif" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Mind.pif" touched "Shell Copy Hook" (Path: "HKCU\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\INPROCSERVER32")47:T41b,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00005636-00000C47-14995619642] Observed system executable string:""%WINDIR%\System32\cmd.exe" /k copy Secretariat Secretariat.cmd & Secretariat.cmd & exit" [Source: 00000000-00005636-00000C47-14995619642] Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00005664-00000C47-3725960506] Observed system executable string:"%WINDIR%\system32\findstr.exe" [Source: 00000000-00005664-00000C47-5418536826] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00005664-00000C47-9591201426] Observed system executable string:"%WINDIR%\system32\timeout.exe" [Source: 00000000-00005664-00000C47-12310797914] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c timeout /t 10 & del /f /q "%TEMP%\150746\Mind.pif" & rd /s /q "C:\Pr" [Source: 00000000-00000816-00000C47-40598927742], Observed system executable string:"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 7279-50-008622B1]48:T4eb,Process "cmd.exe" (UID: 00000000-00005664) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00005664) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "tasklist.exe" (UID: 00000000-00005668) was launched with new environment variables: "Saturn="m", PROMPT="$P$G", Royal="A", Try="h", Calendar="l", Tones="3", ZgwFEhwLVEntOFj="Mind.pif", Cloudy=".", Officer="P"" Process "tasklist.exe" (UID: 00000000-00005768) was launched with new environment variables: "Eq="150746"" Process "Mind.pif" (UID: 00000000-00006048) was launched with missing environment variables: "Saturn, PROMPT, Eq, Royal, Try, Calendar, Tones, ZgwFEhwLVEntOFj, Cloudy, Officer" Process "timeout.exe" (UID: 00000000-00006032) was launched with new environment variables: "Saturn="m", PROMPT="$P$G", Eq="150746", Royal="A", Try="h", Calendar="l", Tones="3", ZgwFEhwLVEntOFj="Mind.pif", Cloudy=".", Officer="P"" Process "Mind.pif" (UID: 00000000-00000816) was launched with missing environment variables: "Saturn, PROMPT, Eq, Royal, Try, Calendar, Tones, ZgwFEhwLVEntOFj, Cloudy, Officer" Process "timeout.exe" (UID: 00000000-00003092) was launched with new environment variables: "PROMPT="$P$G""49:T4e9,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Mind.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Mind.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Mind.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Mind.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN")4a:T6bb,Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00005636-00000C2B-156563523] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00005636-00000C2B-156663575] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00005636-00000C2B-156766655] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00005636-00000C2B-156971837] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00005636-00000C2B-157081322] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00005636-00000C2B-157185466] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00005636-00000C2B-157310027] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00005636-00000C2B-157412480] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005636-00000C2B-157513031] Observed system executable string:"%WINDIR%\system32\IconCodecService.dll" [Source: 00000000-00005636-00000C2B-158525092] Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00005668-00000C2B-164387326] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00000816-00000C2B-283451768] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000816-00000C2B-286465126] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00000816-00000C2B-288600745] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00000816-00000C2B-291887817]4b:T503,Spawned process "cmd.exe" with commandline "/k copy Secretariat Secretariat.cmd & Secretariat.cmd & exit" (UID: 00000000-00005664) Spawned process "tasklist.exe" (UID: 00000000-00005668) Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe opssvc.exe"" (UID: 00000000-00005692) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe ..." (UID: 00000000-00006012), Spawned process "tasklist.exe" (UID: 00000000-00005768), Spawned process "cmd.exe" with commandline "cmd /c md 150746" (UID: 00000000-00005816), Spawned process "findstr.exe" with commandline "findstr /V "reachedindicatingfindlawfu" Cologne" (UID: 00000000-00005968), Spawned process "cmd.exe" with commandline "cmd /c copy /b Abroad 150746\\e" (UID: 00000000-00005920), Spawned process "Mind.pif" with commandline "150746\\Mind.pif 150746\\e" (UID: 00000000-00006048), Spawned process "timeout.exe" with commandline "timeout 5" (UID: 00000000-00006032), Spawned process "Mind.pif" (UID: 00000000-00000816), Spawned process "cmd.exe" with commandline "/c timeout /t 10 & del /f /q "%TEMP%\\150746\\Mind.pif" & rd /s ..." (UID: 00000000-00002380), Spawned process "timeout.exe" with commandline "timeout /t 10" (UID: 00000000-00003092)4c:T503,Spawned process "cmd.exe" with commandline "/k copy Secretariat Secretariat.cmd & Secretariat.cmd & exit" (UID: 00000000-00005664) Spawned process "tasklist.exe" (UID: 00000000-00005668) Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe opssvc.exe"" (UID: 00000000-00005692) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe ..." (UID: 00000000-00006012), Spawned process "tasklist.exe" (UID: 00000000-00005768), Spawned process "cmd.exe" with commandline "cmd /c md 150746" (UID: 00000000-00005816), Spawned process "findstr.exe" with commandline "findstr /V "reachedindicatingfindlawfu" Cologne" (UID: 00000000-00005968), Spawned process "cmd.exe" with commandline "cmd /c copy /b Abroad 150746\\e" (UID: 00000000-00005920), Spawned process "Mind.pif" with commandline "150746\\Mind.pif 150746\\e" (UID: 00000000-00006048), Spawned process "timeout.exe" with commandline "timeout 5" (UID: 00000000-00006032), Spawned process "Mind.pif" (UID: 00000000-00000816), Spawned process "cmd.exe" with commandline "/c timeout /t 10 & del /f /q "%TEMP%\\150746\\Mind.pif" & rd /s ..." (UID: 00000000-00002380), Spawned process "timeout.exe" with commandline "timeout /t 10" (UID: 00000000-00003092)4d:Te85,"nsc8537.tmp" has type "OpenPGP Public Key"- Location: [%TEMP%\nsc8537.tmp]- [targetUID: 00000000-00005636] "Abroad" has type "data"- Location: [%TEMP%\Abroad]- [targetUID: 00000000-00005636] "dism.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators"- [targetUID: N/A] "DISMHOST.EXE.6A8C86AA.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "Lake" has type "data"- Location: [%TEMP%\Lake]- [targetUID: 00000000-00005636] "Vintage" has type "data"- Location: [%TEMP%\Vintage]- [targetUID: 00000000-00005636] "Banners" has type "data"- Location: [%TEMP%\Banners]- [targetUID: 00000000-00005636] "Timeline" has type "data"- Location: [%TEMP%\Timeline]- [targetUID: 00000000-00005636] "Ensures" has type "Intel i386 COFF object file no line number info stripped 332 sections symbol offset=0x14c014c 21758284 symbols optional header size 332 created Wed Sep 9 19:58:04 1970 2nd section name "X\001X\0""- Location: [%TEMP%\Ensures]- [targetUID: 00000000-00005636] "Flyer" has type "data"- Location: [%TEMP%\Flyer]- [targetUID: 00000000-00005636] "Estates" has type "data"- Location: [%TEMP%\Estates]- [targetUID: 00000000-00005636] "Fx" has type "data"- Location: [%TEMP%\Fx]- [targetUID: 00000000-00005636] "Changed" has type "data"- Location: [%TEMP%\Changed]- [targetUID: 00000000-00005636] "Controversial" has type "data"- Location: [%TEMP%\Controversial]- [targetUID: 00000000-00005636] "Impacts" has type "data"- Location: [%TEMP%\Impacts]- [targetUID: 00000000-00005636] "Fighting" has type "data"- Location: [%TEMP%\Fighting]- [targetUID: 00000000-00005636] "Worry" has type "data"- Location: [%TEMP%\Worry]- [targetUID: 00000000-00005636] "Expects" has type "Apple HFS/HFS+ resource fork map offset 0x9080000 map length 0 data length 0xf8040000 nextResourceMap 0 fileRef 0 attributes 0"- Location: [%TEMP%\Expects]- [targetUID: 00000000-00005636] "Destiny" has type "data"- Location: [%TEMP%\Destiny]- [targetUID: 00000000-00005636] "Therefore" has type "data"- Location: [%TEMP%\Therefore]- [targetUID: 00000000-00005636] "Then" has type "data"- Location: [%TEMP%\Then]- [targetUID: 00000000-00005636] "Tactics" has type "data"- Location: [%TEMP%\Tactics]- [targetUID: 00000000-00005636] "Exception" has type "data"- Location: [%TEMP%\Exception]- [targetUID: 00000000-00005636] "Fails" has type "data"- Location: [%TEMP%\Fails]- [targetUID: 00000000-00005636] "Travelling" has type "data"- Location: [%TEMP%\Travelling]- [targetUID: 00000000-00005636] "Overnight" has type "data"- Location: [%TEMP%\Overnight]- [targetUID: 00000000-00005636] "Venezuela" has type "data"- Location: [%TEMP%\Venezuela]- [targetUID: 00000000-00005636] "Noticed" has type "data"- Location: [%TEMP%\Noticed]- [targetUID: 00000000-00005636] "Lol" has type "data"- Location: [%TEMP%\Lol]- [targetUID: 00000000-00005636] "Race" has type "data"- Location: [%TEMP%\Race]- [targetUID: 00000000-00005636] "Secretariat" has type "ASCII text with very long lines (432) with CRLF line terminators"- Location: [%TEMP%\Secretariat]- [targetUID: 00000000-00005636] "Reasons" has type "data"- Location: [%TEMP%\Reasons]- [targetUID: 00000000-00005636] "Voice" has type "data"- Location: [%TEMP%\Voice]- [targetUID: 00000000-00005636] "Cologne" has type "data"- Location: [%TEMP%\Cologne]- [targetUID: 00000000-00005636] "US90ULNP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\US90ULNP.txt]- [targetUID: 00000000-00000816] "Secretariat.cmd" has type "ASCII text with very long lines (432) with CRLF line terminators"- Location: [%TEMP%\Secretariat.cmd]- [targetUID: 00000000-00005664]4e:T8ab,"tasklist.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "Mind.pif" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "Mind.pif" monitors "HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "Mind.pif" monitors "HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "Mind.pif" monitors "HKLM\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) "Mind.pif" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "Mind.pif" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 1)4f:Tb9c,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "")50:T1165,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "52E7510E97F558788067937C97A268AD4951D22F8B94D87855BCB3DD4D6E6708"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "")51:Tc55,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe.Local\" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\UXTHEME.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\USERENV.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\SETUPAPI.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\FLTLIB.DLL" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\MSVCP140.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\VCRUNTIME140.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\ucrtbase.DLL" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll"52:T513,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Mind.pif" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "Mind.pif" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "Mind.pif" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "Mind.pif" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "Mind.pif" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\US90ULNP.txt" "Mind.pif" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Mind.pif" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "Mind.pif" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "Mind.pif" touched file "%APPDATA%\Microsoft\Windows\Cookies" "Mind.pif" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "Mind.pif" touched file "%APPDATA%\Microsoft\Windows\Cookies\US90ULNP.txt" "Mind.pif" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"53:Tcf7,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\FLTLIB.DLL" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\MSVCP140.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\ucrtbase.DLL" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"54:T7e3,"52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe.Local\" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Race" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Venezuela" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Fx" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Lol" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Lake" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Voice" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Expects" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Fighting" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Changed" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Cologne" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Abroad" "52e7510e97f558788067937c97a268ad4951d22f8b94d87855bcb3dd4d6e6708.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Impacts"55:T5d9,file/memory contains long string with (Indicator: "WNetAddConnection"; File: "Controversial") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp")56:Td47,Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00000816-00000C2C-276780360") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00000816-00000C2C-276780427") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00000816-00000C2C-276780560") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00000816-00000C2C-276780625") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00000816-00000C2C-276780692") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000816-00000C2C-276780759") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00000816-00000C2C-276780891") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000816-00000C2C-282704037") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00000816-00000C2C-282704353") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000816.00000000.81068.00290000.00000002.mdmp, 00000000-00000816.00000001.82185.00290000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006048.00000002.78350.00290000.00000002.mdmp")57:T2740,"GET /memve4erin HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache" "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Mon, 24 Aug 2026 15:38:49 GMTContent-Type: text/html; charset=utf-8Content-Length: 9632Connection: keep-aliveSet-Cookie: stel_ssid=230c236e2cc9bc4b53_17469521614774766121; expires=Tue, 25 Aug 2026 15:38:49 GMT; path=/; samesite=None; secure; HttpOnlyPragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgContent-Security-Policy: frame-ancestors https://web.telegram.orgStrict-Transport-Security: max-age=35768000 Telegram: Contact @memve4erin link href="/css/myriad.css" rel="stylesheet"-->

Download

If you have Telegram, you can contact @memve4erin right away.

Send Message

WEBOGRAM_BTN --> PRIVACY_BTN -->