24:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean malicious.d3cb3c — Falcon Sandbox Report — Sample 675ab42b6986…","description":"Clean verdict for sandbox report 64803c18d132…. Malware family: malicious.d3cb3c. 1 malicious and 10 suspicious behavioral indicators across 129 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2/64803c18d132022006030c68","keywords":["Clean","malicious.d3cb3c","sandbox report","malware analysis","MITRE ATT\u0026CK","675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2"],"about":{"@type":"SoftwareApplication","name":"WinXCorners.exe","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2","additionalType":"Clean sample"},"malwareFamily":"malicious.d3cb3c","sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":1,"suspicious":10,"totalSignatures":129},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////AAAAAAAAAAAA/////////wAAAAAAAAAAAAAAD//wAAAAAAAAAAAAAAAAAA//8AAAAAAAAAAAAAAAAAAP//AAAAAAAAAAAAAAAAAAD//wAAAAAAAAD///////////////////////////////////////////8AAAAAAAAAAAAAAAAAAP//D//wAAAAAAAAAAAP//D//w//8AAAAAAAAAAAD//w//8P//AAAAAAAAAAAA//8P//D//wAAAAAAAAAAAP//D//wAAAAAAAAAAAAAAAAAA//8AAAAAAAAAAAAAAAAAAP//AAAAAAAAAAAAAAAAAAD//wAAAAAAAAAAAAAAAAAA//8AAAAAAAAAAAAAAAAAAP//AAAAAAAAAAAAAAAAAAD//w//8AAAAAAAAAAAD//w//8P//AAAAAAAAAAAA//8P//D//wAAAAAAAAAAAP//D//w//8AAAAAAAAAAAD//w//8AAAAAAAAAAAAAAAAAAP///////////////////////////////////////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////+AAf//gAH///w////8P////D////w//wAAAAAAAAAAP////CH//4Qh//+EIf//hCH//4Q////8P////D////w////8P////D////wh//+EIf//hCH//4Qh//+EP////AAAAAAAAAAA/////////////////////w==26:T84d,"WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9967992'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9966040'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9968008'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9966056'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9968024'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9966072'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9968040'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9966088'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9968072'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter " (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9968136'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9966904'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9966952'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '1973092352', 'hResInfo': '3081712'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9967928'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '1947402240', 'hResInfo': '1948777632'}" (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource with parameter {'hModule': '1944780800', 'hResInfo': '55678896'}" (UID: 00000000-00002956)27:T56d,Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp")28:T83b,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002956.00000000.66828.008F0000.00000004.mdmp, 00000000-00002956.00000001.68750.008F0000.00000004.mdmp, 00000000-00002956.00000002.70669.008F0000.00000004.mdmp, 00000000-00002956.00000003.78288.008F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002956.00000000.66828.008F0000.00000004.mdmp, 00000000-00002956.00000001.68750.008F0000.00000004.mdmp, 00000000-00002956.00000002.70669.008F0000.00000004.mdmp, 00000000-00002956.00000003.78288.008F0000.00000004.mdmp") Found string "!"#$%&'()*+,-./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002956.00000000.66828.008F0000.00000004.mdmp, 00000000-00002956.00000001.68750.008F0000.00000004.mdmp, 00000000-00002956.00000002.70669.008F0000.00000004.mdmp, 00000000-00002956.00000003.78288.008F0000.00000004.mdmp"), Found string "!"#$%&'()*+ -./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002956.00000000.66828.008F0000.00000004.mdmp 00000000-00002956.00000001.68750.008F0000.00000004.mdmp 00000000-00002956.00000002.70669.008F0000.00000004.mdmp 00000000-00002956.00000003.78288.008F0000.00000004.mdmp")29:T96c,Found reference to "PKCS5_PBKDF2_HMAC_SHA1" (Indicator: "HMAC"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to "HMAC_CTX_init" (Indicator: "HMAC"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to "HMAC_CTX_cleanup" (Indicator: "HMAC"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to "IdHMACSHA1" (Indicator: "HMAC"; File: "00000000-00002956.00000003.78288.00908000.00000002.mdmp") Found reference to "IdHMACSHA1" (Indicator: "HMACSHA1"; File: "00000000-00002956.00000003.78288.00908000.00000002.mdmp") Found reference to "IdHMAC" (Indicator: "HMAC"; File: "00000000-00002956.00000003.78288.00908000.00000002.mdmp") Found reference to "IdHMACSHA1" (Indicator: "HMAC"; Source: "00000000-00002956.00000000.66828.00908000.00000002.mdmp, 00000000-00002956.00000001.68750.00908000.00000002.mdmp, 00000000-00002956.00000002.70669.00908000.00000002.mdmp, 00000000-00002956.00000003.78288.00908000.00000002.mdmp") Found reference to "IdHMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00002956.00000000.66828.00908000.00000002.mdmp, 00000000-00002956.00000001.68750.00908000.00000002.mdmp, 00000000-00002956.00000002.70669.00908000.00000002.mdmp, 00000000-00002956.00000003.78288.00908000.00000002.mdmp") Found reference to "IdHMAC" (Indicator: "HMAC"; Source: "00000000-00002956.00000000.66828.00908000.00000002.mdmp, 00000000-00002956.00000001.68750.00908000.00000002.mdmp, 00000000-00002956.00000002.70669.00908000.00000002.mdmp, 00000000-00002956.00000003.78288.00908000.00000002.mdmp") file/memory contains long string with (Indicator: "Oid"; Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp")2a:T23c5,Contains long base64 encoded string "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0123456789ABCDEF" in [Source : 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp] Contains long base64 encoded string "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX" in [Source : 00000000-00002956.00000001.68750.03450000.00000002.mdmp 00000000-00002956.00000002.70669.03450000.00000002.mdmp 00000000-00002956.00000003.78288.03450000.00000002.mdmp]2b:T7b2,"WinXCorners.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000080000000000000006523004600221f0001000000000000000a00280008000000d8df1e00d8df1e00d3df1e00000000000000000000001c0000000001b4fc12000000000020ff120095e13f774c4f0700feffffff435c437750594377c0010000c8010000d2df1e00d0df1e0054fe12000000000058fe1200000000004096437780a0567718fe1200d89c1e000000000000000000000000000000000018fe120054fe1200d8df1e00ff2b4377118f4000100dbd01398a400001000000a062400000000000fa88400018fe12006a010000ffffffff100dbd01 (UID: 00000000-00002956) "WinXCorners.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000366afeffffffcd75477564561f77d40000009c504277e26b4775d4000000d40000008cfe1200b0ea1e77d4000000d400000000ff120035c2df68d40000006a01000044c2df68150016000d0000000000000000000000000000000000000000000000000000000000000000000000433a5c30463738423935362d393039442d343542322d384238442d321c5c427743794775ffffffff0c0000004c6242771f794775ffffffff0c00000010ff120004000000a03f8e000380000034ff12008df142000280000095f1420047000000028000000000b2750000721360ff1200e8a95300 (UID: 00000000-00002956) "WinXCorners.exe" called "RtlGetVersion" (UID: 00000000-00002956) "WinXCorners.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001e00e06a1c003200020001000000f40100000a0000000000000000000000204b1e00c201000009000000a86f1c00050000000000000032000000a896200088f21200cc414477c88e200028000000fc000000ff2b4377ecaf5677e055ed73ac011c0000001c0031000700010000000000ffff2c060000040000000100000032000200010000000300000001000000f06d1c0028f31200f06d1c00f807000020000000784a1e0000000000184b1e00e06a1c00006c1c00e08e2000a86f1c000000dc0004f2120095e13f77f8f3120095e13f77000000004cf31200a86cdc00dcf21200 (UID: 00000000-00002956)2c:T46f,"WinXCorners.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002956) "WinXCorners.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47d173b05320008c47d17300000000b0532000c4fe1200086d437718814b7700000000f8a58f000000000016e4241f04ff120095e13f77a44c0700feffffff6b2c447731194875021000000000000000000100d8fe1200c89f43778c47d1730000000000000000 (UID: 00000000-00002956) "WinXCorners.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efefeb739063441c0200000044c7eb7300001300aecaeb73dc6cdc00a86cdc0038f3120000000000f8f3120044d6ec730c7fbd6ffeffffffefefeb736defeb73aecaeb738cf3120090e8eb73aecaeb7367c173752875ed73a8f31200c2c6eb732875ed7300000000d8f4120000000000 (UID: 00000000-00002956)2d:T891,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API "105204916995,3796,109,,GetWindowTextW,user32.dll,"252:03:28.203",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002956.00000001.68750.001C0000.00000004.mdmp") Found reference to API "421030074643,3796,105,,GetForegroundWindow,user32.dll,"252:05:57.187",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00002956.00000003.78288.001C0000.00000004.mdmp")2e:T154b,"WinXCorners.exe" called "GetNativeSystemInfo" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "GetLocaleInfoW" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "RtlGetVersion" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "LoadResource" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "CreateToolhelp32Snapshot" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "RtlGetNtProductType" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "LookupAccountSidW" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "CreateCompatibleBitmap" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "FindResourceW" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "GetActiveWindow" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "EnumWindows" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "GetWindowTextW" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "OpenMutexW" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "IsWow64Process" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "GetForegroundWindow" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQueryInformationProcess" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQuerySystemInformation" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtAllocateVirtualMemory" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenDirectoryObject" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQueryVolumeInformationFile" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenSection" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtMapViewOfSection" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtDelayExecution" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtProtectVirtualMemory" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtCreateSection" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtConnectPort" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtRequestWaitReplyPort" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenProcessToken" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQueryInformationToken" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQueryAttributesFile" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtSetInformationProcess" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtUnmapViewOfSection" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtCreateMutant" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtCreateEvent" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtDeviceIoControlFile" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQueryVirtualMemory" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenFile" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQuerySystemTime" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtAlpcSendWaitReceivePort" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtCreateThreadEx" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtResumeThread" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtAlertThread" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenEvent" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenThreadToken" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtWaitForMultipleObjects" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenMutant" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtCreateFile" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenKeyEx" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQueryValueKey" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQueryInformationFile" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtEnumerateValueKey" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "LdrGetDllHandle" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "LdrGetProcedureAddress" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "LdrLoadDll" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "FindWindowExW" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "LdrUnloadDll" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "RpcStringBindingComposeW" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtReadFile" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtQueryKey" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtEnumerateKey" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "GetVersionExA" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtOpenProcess" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "NtTerminateProcess" (PID: 2956) (UID: 00000000-00002956) "WinXCorners.exe" called "GetKeyState" (PID: 2956) (UID: 00000000-00002956)2f:Tcc0,"WinXCorners.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter security.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DUser.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\xmllite.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter DUser.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002956) "WinXCorners.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00002956)30:T5b73,"WinXCorners.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter WinStationRegisterConsoleNotification (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter InitGadgets (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegisterMessagePumpHook (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateGadget (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetGadgetMessageFilter (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetGadgetStyle (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetGadgetRootInfo (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FindStdColor (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter AttachWndProcW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetGadgetTicket (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter InvalidateGadget (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetGadgetFocus (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetGadgetFocus (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter ForwardGadgetMessage (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetGadgetRgn (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter DUserSendEvent (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter SetGadgetRect (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00002956) "WinXCorners.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00002956)31:T1149,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")32:T463,select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.")33:T463,select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.")34:Tfc32,Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetThreadUILanguage"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetLongPathNameW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "SetEvent"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "ResetEvent"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetObject"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "Sleep"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetSystemTimes"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetTickCount"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "InitializeConditionVariable"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WakeConditionVariable"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "CoInitializeEx"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "AnimateWindow"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "IsWow64Process"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetTickCount64"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAStartup"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSACleanup"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "closesocket"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "ioctlsocket"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "getpeername"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "getsockname"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "getsockopt"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "htonl"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "htons"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "inet_addr"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "inet_ntoa"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "ntohl"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "ntohs"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "recvfrom"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "gethostbyaddr"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "gethostbyname"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "gethostname"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "getservbyport"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "getservbyname"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "getprotobynumber"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "getprotobyname"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSASetLastError"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAGetLastError"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAsyncGetServByName"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAsyncGetServByPort"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAsyncGetProtoByName"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAsyncGetProtoByNumber"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAsyncGetHostByName"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAsyncGetHostByAddr"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSACancelAsyncRequest"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAsyncSelect"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "__WSAFDIsSet"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAGetOverlappedResult"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAIoctl"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSASocketA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAddressToStringA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAAddressToStringW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAStringToAddressA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAStringToAddressW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSALookupServiceBeginA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSALookupServiceBeginW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSALookupServiceNextA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSALookupServiceNextW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSALookupServiceEnd"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAInstallServiceClassA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAInstallServiceClassW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSARemoveServiceClass"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAGetServiceClassInfoA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAGetServiceClassInfoW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAGetServiceClassNameByClassIdA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSAGetServiceClassNameByClassIdW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSASetServiceA"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSASetServiceW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "TransmitFile"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetAcceptExSockaddrs"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "AcceptEx"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "WSARecvEx"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "IdnToUnicode"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "IdnToNameprepUnicode"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "IdnToAscii"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "IsNormalizedString"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "NormalizeString"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetIpAddrTable"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetUniDirectionalAdapterInfo"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetAdaptersInfo"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "EncryptMessage"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "DecryptMessage"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "FreeContextBuffer"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "AcquireCredentialsHandleW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "FreeCredentialsHandle"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "InitializeSecurityContextW"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "DeleteSecurityContext"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CopyImage"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetTimer"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "BeginPaint"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "OffsetRect"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetMenuStringW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetScrollRange"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetScrollPos"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetScrollPos"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawEdge"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "InflateRect"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawFocusRect"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetCapture"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ScrollWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShowCaret"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemID"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsZoomed"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetClipboardData"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetClipboardData"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsIconic"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CheckMenuItem"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharUpperW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnableWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetParent"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MessageBeep"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "UpdateWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSubMenu"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DestroyMenu"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EmptyClipboard"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetTopWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawIcon"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardState"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawFrameControl"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ScreenToClient"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreateIcon"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreateMenu"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "RemoveMenu"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MapWindowPoints"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CloseClipboard"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DestroyCursor"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "UpdateLayeredWindow"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnableScrollBar"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CopyIcon"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawIconEx"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShowScrollBar"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnableMenuItem"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetIconInfo"; File: "00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetScrollPos"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ScrollWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShowCaret"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CheckMenuItem"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ActivateKeyboardLayout"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawIcon"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreateIcon"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "RemoveMenu"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DestroyCursor"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "UpdateLayeredWindow"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "CopyIcon"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "ShowScrollBar"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp")35:T6af,"Software\Embarcadero\Locales" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "Software\CodeGear\Locales" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "Software\Borland\Locales" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "Software\Borland\Delphi\Locales" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002956.00000000.66828.7F6F0000.00000002.mdmp 00000000-00002956.00000001.68750.7F6F0000.00000002.mdmp 00000000-00002956.00000002.70669.7F6F0000.00000002.mdmp 00000000-00002956.00000003.78288.7F6F0000.00000002.mdmp36:T11ab,"WinXCorners.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 773E0000 "WinXCorners.exe" loaded module "C:\WinXCorners.exe" at 00400000 "WinXCorners.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 771A0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 75470000 "WinXCorners.exe" loaded module "%WINDIR%\System32\winspool.drv" at 71960000 "WinXCorners.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 75730000 "WinXCorners.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 77540000 "WinXCorners.exe" loaded module "%WINDIR%\System32\user32.dll" at 759B0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\lpk.dll" at 757E0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\usp10.dll" at 77590000 "WinXCorners.exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" at 74130000 "WinXCorners.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 75690000 "WinXCorners.exe" loaded module "%WINDIR%\System32\shell32.dll" at 76400000 "WinXCorners.exe" loaded module "%WINDIR%\System32\version.dll" at 74860000 "WinXCorners.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 77100000 "WinXCorners.exe" loaded module "%WINDIR%\System32\ole32.dll" at 77280000 "WinXCorners.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75DD0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 77050000 "WinXCorners.exe" loaded module "%WINDIR%\System32\sechost.dll" at 75670000 "WinXCorners.exe" loaded module "%WINDIR%\System32\netapi32.dll" at 73830000 "WinXCorners.exe" loaded module "%WINDIR%\System32\netutils.dll" at 742D0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\srvcli.dll" at 74EE0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\wkscli.dll" at 74100000 "WinXCorners.exe" loaded module "%WINDIR%\System32\winhttp.dll" at 709E0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\webio.dll" at 70990000 "WinXCorners.exe" loaded module "%WINDIR%\System32\imm32.dll" at 00170000 "WinXCorners.exe" loaded module "%WINDIR%\System32\imm32.dll" at 757F0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\msctf.dll" at 75B20000 "WinXCorners.exe" loaded module "%WINDIR%\WindowsShell.Manifest" at 00190000 "WinXCorners.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 68DF0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 75A80000 "WinXCorners.exe" loaded module "%WINDIR%\System32\nsi.dll" at 77530000 "WinXCorners.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 70660000 "WinXCorners.exe" loaded module "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" at 72490000 "WinXCorners.exe" loaded module "%WINDIR%\System32\samcli.dll" at 73820000 "WinXCorners.exe" loaded module "%WINDIR%\System32\tzres.dll" at 002C0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 73EE0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\wtsapi32.dll" at 74780000 "WinXCorners.exe" loaded module "%WINDIR%\System32\winsta.dll" at 75250000 "WinXCorners.exe" loaded module "%WINDIR%\Fonts\StaticCache.dat" at 025A0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\en-US\user32.dll.mui" at 002F0000 "WinXCorners.exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\GdiPlus.dll" at 73BA0000 "WinXCorners.exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 03080000 "WinXCorners.exe" loaded module "%WINDIR%\System32\security.dll" at 72330000 "WinXCorners.exe" loaded module "%WINDIR%\System32\secur32.dll" at 75020000 "WinXCorners.exe" loaded module "%WINDIR%\System32\sspicli.dll" at 75170000 "WinXCorners.exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\comctl32.dll.mui" at 00310000 "WinXCorners.exe" loaded module "%WINDIR%\System32\duser.dll" at 73EB0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\xmllite.dll" at 73A80000 "WinXCorners.exe" loaded module "%WINDIR%\System32\en-US\msctf.dll.mui" at 00350000 "WinXCorners.exe" loaded module "%WINDIR%\System32\clbcatq.dll" at 75E80000 "WinXCorners.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 68DA0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 751E0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\dwmapi.dll" at 73AB0000 "WinXCorners.exe" loaded module "%WINDIR%\System32\imageres.dll" at 0362000037:T902,"WinXCorners.exe" loaded module "KERNEL32.DLL" at base 771a0000 "WinXCorners.exe" loaded module "MSCTF.DLL" at base 75b20000 "WinXCorners.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ee0000 "WinXCorners.exe" loaded module "CRYPTBASE.DLL" at base 751e0000 "WinXCorners.exe" loaded module "WTSAPI32.DLL" at base 74780000 "WinXCorners.exe" loaded module "USER32.DLL" at base 759b0000 "WinXCorners.exe" loaded module "WINSTA.DLL" at base 75250000 "WinXCorners.exe" loaded module "ADVAPI32.DLL" at base 77050000 "WinXCorners.exe" loaded module "RPCRT4.DLL" at base 75dd0000 "WinXCorners.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75670000 "WinXCorners.exe" loaded module "UXTHEME.DLL" at base 73ee0000 "WinXCorners.exe" loaded module "GDIPLUS.DLL" at base 73ba0000 "WinXCorners.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73ba0000 "WinXCorners.exe" loaded module "SECURITY.DLL" at base 72330000 "WinXCorners.exe" loaded module "COMCTL32.DLL" at base 74130000 "WinXCorners.exe" loaded module "NTDLL.DLL" at base 773e0000 "WinXCorners.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 73eb0000 "WinXCorners.exe" loaded module "DWMAPI.DLL" at base 73ab0000 "WinXCorners.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 73a80000 "WinXCorners.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77280000 "WinXCorners.exe" loaded module "CLBCATQ.DLL" at base 75e80000 "WinXCorners.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75b20000 "WinXCorners.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72490000 "WinXCorners.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WinXCorners.exe" loaded module "KERNEL32" at base 771a0000 "WinXCorners.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WinXCorners.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68da0000 "WinXCorners.exe" loaded module "IMM32.DLL" at base 757f0000 "WinXCorners.exe" loaded module "COMCTL32" at base 74130000 "WinXCorners.exe" loaded module "DUSER.DLL" at base 73eb0000 "WinXCorners.exe" loaded module "OLE32.DLL" at base 77280000 "WinXCorners.exe" loaded module "OLEAUT32.DLL" at base 7710000038:T1149,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")39:T463,select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.")3a:T463,select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.")3b:T1b57,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002956-00000C24-19003068] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00002956-00000C24-20252826] Observed system executable string:"%WINDIR%\system32\DUser.dll" [Source: 00000000-00002956-00000C24-21045603] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00002956-00000C24-21686723] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00002956-00000C24-22222725] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00002956-00000C24-22382854] Observed system executable string:"C:\Windows\Temp\VxOle32.dll" [Source: 00000000-00002956.00000000.66828.00010000.00000040.mdmp 00000000-00002956.00000000.66828.003C0000.00000002.mdmp 00000000-00002956.00000001.68750.00010000.00000040.mdmp 00000000-00002956.00000001.68750.003C0000.00000002.mdmp 00000000-00002956.00000002.70669.00010000.00000040.mdmp 00000000-00002956.00000002.70669.003C0000.00000002.mdmp 00000000-00002956.00000003.78288.00010000.00000040.mdmp 00000000-00002956.00000003.78288.003C0000.00000002.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL32.dll" [Source: 00000000-00002956.00000000.66828.00020000.00000040.mdmp 00000000-00002956.00000000.66828.00190000.00000002.mdmp 00000000-00002956.00000001.68750.00020000.00000040.mdmp 00000000-00002956.00000001.68750.00190000.00000002.mdmp 00000000-00002956.00000002.70669.00020000.00000040.mdmp 00000000-00002956.00000002.70669.00190000.00000002.mdmp 00000000-00002956.00000003.78288.00020000.00000040.mdmp 00000000-00002956.00000003.78288.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoa.dll" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp 00000000-00002956.00000001.68750.00130000.00000002.mdmp 00000000-00002956.00000002.70669.00130000.00000002.mdmp 00000000-00002956.00000003.78288.00130000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\GdiPlus.dll" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp 00000000-00002956.00000001.68750.00130000.00000002.mdmp 00000000-00002956.00000002.70669.00130000.00000002.mdmp 00000000-00002956.00000003.78288.00130000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp 00000000-00002956.00000001.68750.00130000.00000002.mdmp 00000000-00002956.00000002.70669.00130000.00000002.mdmp 00000000-00002956.00000003.78288.00130000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoaps.dll" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp 00000000-00002956.00000001.68750.00130000.00000002.mdmp 00000000-00002956.00000002.70669.00130000.00000002.mdmp 00000000-00002956.00000003.78288.00130000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll.mui" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp 00000000-00002956.00000001.68750.00130000.00000002.mdmp 00000000-00002956.00000002.70669.00130000.00000002.mdmp 00000000-00002956.00000003.78288.00130000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\uxtheme.dll" [Source: 00000000-00002956.00000000.66828.00160000.00000004.mdmp 00000000-00002956.00000001.68750.00160000.00000004.mdmp 00000000-00002956.00000002.70669.00160000.00000004.mdmp 00000000-00002956.00000003.78288.00160000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\ntdll.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\kernel32.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\KERNELBASE.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\msvcrt.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\GDI32.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\USER32.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\LPK.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\USP10.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\SHLWAPI.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\shell32.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\version.dll" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp 00000000-00002956.00000001.68750.001C0000.00000004.mdmp 00000000-00002956.00000002.70669.001C0000.00000004.mdmp 00000000-00002956.00000003.78288.001C0000.00000004.mdmp]3c:T2c5f,"WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\EMBARCADERO\LOCALES"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\EMBARCADERO\LOCALES"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\CODEGEAR\LOCALES"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CODEGEAR\LOCALES"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\BORLAND\LOCALES"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\BORLAND\DELPHI\LOCALES"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTSUBSTITUTES"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTLINK\SYSTEMLINK"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK\SEGOE UI"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\VIDEO\{8FE042CE-FE53-4517-9B5E-ADE4C2FC3C64}\0000"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_80EE&DEV_BEEF&SUBSYS_040515AD&REV_00\3&267A616A&0&10"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\DIRECTUI"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\COMPATIBILITY\WINXCORNERS.EXE"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\LANGUAGEPROFILE\0X00000000\{0001BEA3-ED56-483D-A2E2-AEAE25577436}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{FA445657-9379-11D6-B41A-00065B83EE53}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APP MANAGEMENT"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APP MANAGEMENT"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\CTF\DIRECTSWITCHHOTKEYS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\KNOWNCLASSES"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "")3d:T2153,"WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WINXCORNERS"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTSUBSTITUTES"; Key: "MS SHELL DLG 2"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DISABLE"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DATAFILEPATH"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE1"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE2"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE3"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE4"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE5"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE6"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE7"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE8"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE9"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE10"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE11"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE12"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE13"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE14"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE15"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE16"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: "MAXOBJECTNUMBER"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: "\DEVICE\VIDEO3"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\VIDEO\{8FE042CE-FE53-4517-9B5E-ADE4C2FC3C64}\0000"; Key: "PRUNINGMODE"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_80EE&DEV_BEEF&SUBSYS_040515AD&REV_00\3&267A616A&0&10"; Key: "HARDWAREID"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: "CURRENTVERSION"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\LANGUAGEPROFILE\0X00000000\{0001BEA3-ED56-483D-A2E2-AEAE25577436}"; Key: "ENABLE"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE"; Key: "LANGUAGE HOTKEY"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE"; Key: "HOTKEY"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE"; Key: "LAYOUT HOTKEY"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF"; Key: "ENABLEANCHORCONTEXT"; Value: "") "WinXCorners.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "TURNOFFSPIANIMATIONS"; Value: "")3e:T2c94,"WinXCorners.exe" trying to touch file "C:\winspool.drv" "WinXCorners.exe" trying to touch file "C:\Windows\system32\winspool.drv" "WinXCorners.exe" trying to touch file "C:\WinXCorners.exe.Local\" "WinXCorners.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "WinXCorners.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "WinXCorners.exe" trying to touch file "C:\version.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\version.dll" "WinXCorners.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "WinXCorners.exe" trying to touch file "C:\netapi32.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\netapi32.dll" "WinXCorners.exe" trying to touch file "C:\netutils.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\netutils.dll" "WinXCorners.exe" trying to touch file "C:\srvcli.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\srvcli.dll" "WinXCorners.exe" trying to touch file "C:\wkscli.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\wkscli.dll" "WinXCorners.exe" trying to touch file "C:\winhttp.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\winhttp.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "WinXCorners.exe" trying to touch file "C:\FLTLIB.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "WinXCorners.exe" trying to touch file "C:\CRYPTBASE.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "WinXCorners.exe" trying to touch file "\Device\KsecDD" "WinXCorners.exe" trying to touch file "C:\wtsapi32.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\wtsapi32.dll" "WinXCorners.exe" trying to touch file "C:\WINSTA.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\WINSTA.dll" "WinXCorners.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e" "WinXCorners.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" "WinXCorners.exe" trying to touch file "C:\security.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\security.dll" "WinXCorners.exe" trying to touch file "C:\SECUR32.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\system32\SECUR32.DLL" "WinXCorners.exe" trying to touch file "C:\SSPICLI.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\system32\SSPICLI.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9" "WinXCorners.exe" trying to touch file "C:\DUser.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\DUser.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\xmllite.dll" "WinXCorners.exe" trying to touch file "C:\imageres.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\imageres.dll" "WinXCorners.exe" trying to touch file "C:\webio.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\webio.dll" "WinXCorners.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "WinXCorners.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "WinXCorners.exe" trying to touch file "C:\Windows\system32\tzres.dll" "WinXCorners.exe" trying to touch file "C:\WINSPOOL.DRV" "WinXCorners.exe" trying to touch file "C:\Windows\System32\winspool.drv" "WinXCorners.exe" trying to touch file "C:\WINXCORNERS.EXE.LOCAL" "WinXCorners.exe" trying to touch file "C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "WinXCorners.exe" trying to touch file "C:\VERSION.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\version.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\sechost.dll" "WinXCorners.exe" trying to touch file "C:\NETAPI32.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\netapi32.dll" "WinXCorners.exe" trying to touch file "C:\NETUTILS.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\netutils.dll" "WinXCorners.exe" trying to touch file "C:\SRVCLI.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\srvcli.dll" "WinXCorners.exe" trying to touch file "C:\WKSCLI.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\wkscli.dll" "WinXCorners.exe" trying to touch file "C:\WINHTTP.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\winhttp.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\webio.dll" "WinXCorners.exe" trying to touch file "C:\dwmapi.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\dwmapi.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WinXCorners.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "WinXCorners.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "WinXCorners.exe" trying to touch file "C:\SAMCLI.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\samcli.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\tzres.dll" "WinXCorners.exe" trying to touch file "C:\Windows\system32\uxtheme.dll.Config" "WinXCorners.exe" trying to touch file "C:\Windows\System32\uxtheme.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\rpcss.dll" "WinXCorners.exe" trying to touch file "C:\CRYPTBASE.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\dwmapi.dll" "WinXCorners.exe" trying to touch file "C:\WTSAPI32.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\wtsapi32.dll" "WinXCorners.exe" trying to touch file "C:\WINSTA.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\winsta.dll" "WinXCorners.exe" trying to touch file "C:\Windows\Fonts\StaticCache.dat" "WinXCorners.exe" trying to touch file "C:\Windows\System32\en-US\user32.dll.mui" "WinXCorners.exe" trying to touch file "C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\GdiPlus.dll" "WinXCorners.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WinXCorners.exe" trying to touch file "C:\SECURITY.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\security.dll" "WinXCorners.exe" trying to touch file "C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\comctl32.dll.mui" "WinXCorners.exe" trying to touch file "C:\DUSER.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\duser.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\xmllite.dll" "WinXCorners.exe" trying to touch file "C:\IMAGERES.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\imageres.dll" "WinXCorners.exe" trying to touch file "C:\Windows\System32\en-US\msctf.dll.mui" "WinXCorners.exe" trying to touch file "C:\WEBIO.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\cryptbase.dll" "WinXCorners.exe" trying to touch file "C:\DWMAPI.DLL" "WinXCorners.exe" trying to touch file "C:\Windows\System32\UXTHEME.DLL.CONFIG" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\winspool.drv" "WinXCorners.exe" trying to touch file "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\version.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\sechost.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\netapi32.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\netutils.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\srvcli.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\wkscli.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\winhttp.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\webio.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\imm32.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\WindowsShell.Manifest" "WinXCorners.exe" trying to touch file "%WINDIR%\Temp\VxSSL32.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\fltLib.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\samcli.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\tzres.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\rpcss.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\wtsapi32.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\winsta.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\Fonts\StaticCache.dat" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\en-US\user32.dll.mui" "WinXCorners.exe" trying to touch file "%WINDIR%\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\GdiPlus.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\security.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\secur32.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\sspicli.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\comctl32.dll.mui" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\duser.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\xmllite.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\en-US\msctf.dll.mui" "WinXCorners.exe" trying to touch file "%WINDIR%\Temp\VxOle32.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\cryptbase.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\dwmapi.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\UXTHEME.DLL.CONFIG" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\uxtheme.dll" "WinXCorners.exe" trying to touch file "%WINDIR%\System32\imageres.dll"3f:Ta9e,"WinXCorners.exe" trying to access non-existent file "C:\version.dll" "WinXCorners.exe" trying to access non-existent file "C:\netapi32.dll" "WinXCorners.exe" trying to access non-existent file "C:\netutils.dll" "WinXCorners.exe" trying to access non-existent file "C:\srvcli.dll" "WinXCorners.exe" trying to access non-existent file "C:\wkscli.dll" "WinXCorners.exe" trying to access non-existent file "C:\winhttp.dll" "WinXCorners.exe" trying to access non-existent file "C:\FLTLIB.DLL" "WinXCorners.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "WinXCorners.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "WinXCorners.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "WinXCorners.exe" trying to access non-existent file "C:\wtsapi32.dll" "WinXCorners.exe" trying to access non-existent file "C:\WINSTA.dll" "WinXCorners.exe" trying to access non-existent file "C:\security.dll" "WinXCorners.exe" trying to access non-existent file "C:\SECUR32.DLL" "WinXCorners.exe" trying to access non-existent file "C:\SSPICLI.DLL" "WinXCorners.exe" trying to access non-existent file "C:\DUser.dll" "WinXCorners.exe" trying to access non-existent file "C:\imageres.dll" "WinXCorners.exe" trying to access non-existent file "C:\webio.dll" "WinXCorners.exe" trying to access non-existent file "C:\VERSION.DLL" "WinXCorners.exe" trying to access non-existent file "C:\NETAPI32.DLL" "WinXCorners.exe" trying to access non-existent file "C:\NETUTILS.DLL" "WinXCorners.exe" trying to access non-existent file "C:\SRVCLI.DLL" "WinXCorners.exe" trying to access non-existent file "C:\WKSCLI.DLL" "WinXCorners.exe" trying to access non-existent file "C:\WINHTTP.DLL" "WinXCorners.exe" trying to access non-existent file "C:\dwmapi.dll" "WinXCorners.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "WinXCorners.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "WinXCorners.exe" trying to access non-existent file "C:\SAMCLI.DLL" "WinXCorners.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "WinXCorners.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "WinXCorners.exe" trying to access non-existent file "C:\WINSTA.DLL" "WinXCorners.exe" trying to access non-existent file "C:\SECURITY.DLL" "WinXCorners.exe" trying to access non-existent file "C:\DUSER.DLL" "WinXCorners.exe" trying to access non-existent file "C:\IMAGERES.DLL" "WinXCorners.exe" trying to access non-existent file "C:\WEBIO.DLL" "WinXCorners.exe" trying to access non-existent file "C:\DWMAPI.DLL"40:T56c,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSASend" (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecvMsg" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSASendMsg" (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin")41:T56c,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSASend" (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSARecvMsg" (Indicator: "WSARecv"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin") Found reference to API "WSASendMsg" (Indicator: "WSASend"; File: "675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin")42:T11b6,Heuristic match: "video/vnd.dece.sd" Pattern match: "http://direct:80" Pattern match: "http://apps.codigobit.info/p/support.html" Pattern match: "http://www.indyproject.org/Original" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "Font.Name" Heuristic match: "C+ .Dz" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CM" Pattern match: "http://www.indyproject.org/" Pattern match: "http://www.windows.com/pctv" Pattern match: "http://go.microsoft.com/fwlink/?linkid=53081" Pattern match: "www.microsoft.com/extender/help" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwl" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=70599" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=145837" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=57190" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=145765" Heuristic match: "Example: computer.fabrikam.com" Pattern match: "vista.gallery.microsoft.com/vista/SideShow.aspx" Pattern match: "http://www.icra.org/vocabulary/" Pattern match: "wmploc.dll/Offline_Buy.htm'res://wmploc.dll/Offline_MediaGuide.htm*res://wmploc.dll/Offline_Subscriptions.htm" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=32146res://wmploc.dll/ICW_ErrorPage.htm" Pattern match: "wmploc.dll/Service_Initial.htm" Pattern match: "wmploc.dll/Error_ServiceInfo.htm'res://wmploc.dll/Offline_InfoCenter.htm&res://wmploc.dll/Offline_AlbumInfo.htm" Pattern match: "wmploc.dll/Service_NoFunc.htm%res://wmploc.dll/Service_No_Local.htm" Pattern match: "wmploc.dll/RT_IMAGE/ServiceLarge.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png" Pattern match: "wmploc.dll/Blocked_AlbumInfo.htm&res://wmploc.dll/Blocked_AlbumInfo.htm,http://go.microsoft.com/fwlink/?LinkId=70183'res://wmploc.dll/offline_radioguide.htm" Pattern match: "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/" Pattern match: "redir.metaservices.microsoft.com/dvdcover/P" Pattern match: "http://redir.metaservices.microsoft.com/redir/buynow/" Pattern match: "http://windowsmedia.com/redir/findmedia.asp" Pattern match: "redir.metaservices.microsoft.com/redir/getmdrdvd/" Pattern match: "redir.metaservices.microsoft.com/redir/getmdrcd/?Bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?Ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=h" Pattern match: "redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/QueryTOCExt.asp1res://wmploc.dll/Offline_MediaInfo_NowPlaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=321507Optimized" Pattern match: "http://go.microsoft.com/fwlink/?linkid=8792" Pattern match: "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/QueryTOCNP.asp#Show" Pattern match: "http://windowsmedia.com/redir/services.asp?WMPFriendly=true" Pattern match: "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5" Pattern match: "http://www.w3.org/1999/XSL/Transform" Pattern match: "http://*.microsoft.co.jp" Pattern match: "http://microsoft.*.com" Pattern match: "www.treyresearch.net" Pattern match: "http://treyresearch.net" Heuristic match: "- fineartschool.net" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=226247" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=233329" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=228745" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=787651" Heuristic match: "GridParent.Height = Grid.Height + Grid.Top" Pattern match: "http://www.w3.org/2001/XMLSchema" Pattern match: "http://www.iec.ch" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=121315" Pattern match: "http://go.microsoft.com/fwlink/p/?LinkId=255142"43:T26bc,Found URL "http://www.indyproject.org/original" - Source: "00000000-00002956.00000000.66828.01AE0000.00000004.mdmp") Found URL "http://www.indyproject.org/original" - Source: "00000000-00002956.00000001.68750.01AE0000.00000004.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00002956.00000001.68750.03450000.00000002.mdmp") Found URL "http://timevalue\\uff1e]/[>\\uff1e];[\\?\\uff1f]/[\\?\\uff1f];[@\\uff20]/[@\\uff20];[\\[\\uff3b]/[\\[\\uff3b];[\\\\\\\\uff3c]/[\\\\\\\\uff3c];[]\\uff3d]/[]\\uff3d];[\\^\\uff3e]/[\\^\\uff3e];[_\\uff3f]/[_\\uff3f];[`\\uff40]/[`\\uff40];[\\{\\uff5b]/[\\{\\uff5b];[\\|\\uff5c]/[\\|\\uff5c];[}\\uff5d]/[}\\uff5d];[~\\uff5e]/[~\\uff5e];[\\u3002\\uff61]/[\\u3002\\uff61];[\\u300C\\uff62]/[\\u300C\\uff62];[\\u300D\\uff63]/[\\u300D\\uff63];[\\u3001\\uff64]/[\\u3001\\uff64]M; Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp\")","description_v2":["Found string - !\\uff01]/[!\\uff01];[\"\\uff02]/[\"\\uff02];[\\#\\uff03]/[\\#\\uff03];[\\$\\uff04]/[\\$\\uff04];[%\\uff05]/[%\\uff05];[&\\uff06]/[&\\uff06];[\\u0027\\uff07]/[\\u0027\\uff07];[\$\\uff08]/[\\(\\uff08];[\$\\uff09]/[\\)\\uff09];[\\*\\uff0a]/[\\*\\uff0a];[\\+\\uff0b]/[\\+\\uff0b];[","\\uff0c]/[","\\uff0c];[-\\uff0d]/[-\\uff0d];[\\.\\uff0e]/[\\.\\uff0e];[\\u002f\\uff0f]/[\\u002f\\uff0f];[:\\uff1a]/[:\\uff1a];[\\u003b\\uff1b]/[\\u003b\\uff1b];[<\\uff1c]/[<\\uff1c];[=\\uff1d]/[=\\uff1d];[>\\uff1e]/[>\\uff1e];[\\?\\uff1f]/[\\?\\uff1f];[@\\uff20]/[@\\uff20];[\\[\\uff3b]/[\\[\\uff3b];[\\\\\\\\uff3c]/[\\\\\\\\uff3c];[]\\uff3d]/[]\\uff3d];[\\^\\uff3e]/[\\^\\uff3e];[_\\uff3f]/[_\\uff3f];[`\\uff40]/[`\\uff40];[\\{\\uff5b]/[\\{\\uff5b];[\\|\\uff5c]/[\\|\\uff5c];[}\\uff5d]/[}\\uff5d];[~\\uff5e]/[~\\uff5e];[\\u3002\\uff61]/[\\u3002\\uff61];[\\u300C\\uff62]/[\\u300C\\uff62];[\\u300D\\uff63]/[\\u300D\\uff63];[\\u3001\\uff64]/[\\u3001\\uff64]M; Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string - !\\uff01]/[!\\uff01];[\"\\uff02]/[\"\\uff02];[\\#\\uff03]/[\\#\\uff03];[\\$\\uff04]/[\\$\\uff04];[%\\uff05]/[%\\uff05];[&\\uff06]/[&\\uff06];[\\u0027\\uff07]/[\\u0027\\uff07];[\$\\uff08]/[\\(\\uff08];[\$\\uff09]/[\\)\\uff09];[\\*\\uff0a]/[\\*\\uff0a];[\\+\\uff0b]/[\\+\\uff0b];["},{"type":"linebreak"},{"type":"text","value":"\\uff0c]/["},{"type":"linebreak"},{"type":"text","value":"\\uff0c];[-\\uff0d]/[-\\uff0d];[\\.\\uff0e]/[\\.\\uff0e];[\\u002f\\uff0f]/[\\u002f\\uff0f];[:\\uff1a]/[:\\uff1a];[\\u003b\\uff1b]/[\\u003b\\uff1b];[<\\uff1c]/[<\\uff1c];[=\\uff1d]/[=\\uff1d];[>\\uff1e]/[>\\uff1e];[\\?\\uff1f]/[\\?\\uff1f];[@\\uff20]/[@\\uff20];[\\[\\uff3b]/[\\[\\uff3b];[\\\\\\\\uff3c]/[\\\\\\\\uff3c];[]\\uff3d]/[]\\uff3d];[\\^\\uff3e]/[\\^\\uff3e];[_\\uff3f]/[_\\uff3f];[`\\uff40]/[`\\uff40];[\\{\\uff5b]/[\\{\\uff5b];[\\|\\uff5c]/[\\|\\uff5c];[}\\uff5d]/[}\\uff5d];[~\\uff5e]/[~\\uff5e];[\\u3002\\uff61]/[\\u3002\\uff61];[\\u300C\\uff62]/[\\u300C\\uff62];[\\u300D\\uff63]/[\\u300D\\uff63];[\\u3001\\uff64]/[\\u3001\\uff64]M; Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"static-5","type":0,"relevance":10,"name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","description_v2":["Raw size of \".bss\" is zero","Raw size of \".tls\" is zero"],"description_v3":[{"type":"text","value":"Raw size of \".bss\" is zero"},{"type":"linebreak"},{"type":"text","value":"Raw size of \".tls\" is zero"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-213","type":2,"relevance":1,"name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-212","type":2,"relevance":1,"name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"public key\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")\n file/memory contains long string with (Indicator: \"public key\"; Source: \"00000000-00002956.00000000.66828.00908000.00000002.mdmp, 00000000-00002956.00000001.68750.00908000.00000002.mdmp, 00000000-00002956.00000002.70669.00908000.00000002.mdmp, 00000000-00002956.00000003.78288.00908000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"public key\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","file/memory contains long string with (Indicator: \"public key\"; Source: \"00000000-00002956.00000000.66828.00908000.00000002.mdmp, 00000000-00002956.00000001.68750.00908000.00000002.mdmp, 00000000-00002956.00000002.70669.00908000.00000002.mdmp, 00000000-00002956.00000003.78288.00908000.00000002.mdmp\")","file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"public key\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"public key\"; Source: \"00000000-00002956.00000000.66828.00908000.00000002.mdmp, 00000000-00002956.00000001.68750.00908000.00000002.mdmp, 00000000-00002956.00000002.70669.00908000.00000002.mdmp, 00000000-00002956.00000003.78288.00908000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains long base64 encoded strings","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: Contains long base64 encoded strings"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains long base64 encoded strings"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains long base64 encoded strings\n Matched sigs: Contains reference to cryptographic keys","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Contains ability to encrypt/encode message (API string)","Matched sigs: Contains ability to perform decryption (API string)","Matched sigs: Contains long base64 encoded strings","Matched sigs: Contains reference to cryptographic keys"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to encrypt/encode message (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform decryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains long base64 encoded strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-142","type":6,"relevance":3,"name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WinXCorners.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-146","type":6,"relevance":3,"name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WinXCorners.exe\" called \"IsWow64Process\" with parameter \"2956\" - (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"IsWow64Process\" with parameter \"2956\" - (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"IsWow64Process\" with parameter \"2956\" - (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-152","type":6,"relevance":3,"name":"Calls an API typically used to enumerate active windows","description":"\"WinXCorners.exe\" called \"EnumWindows\" with parameter \"1243732\" - (UID: 00000000-00002956)\n \"WinXCorners.exe\" called \"EnumWindows\" with parameter \"1102288\" - (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"EnumWindows\" with parameter \"1243732\" - (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"EnumWindows\" with parameter \"1102288\" - (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"EnumWindows\" with parameter \"1243732\" - (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"EnumWindows\" with parameter \"1102288\" - (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-151","type":6,"relevance":3,"name":"Calls an API typically used to get active windows title","description":"\"WinXCorners.exe\" called \"GetWindowTextW\" (UID: 00000000-00002956)\n \"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00002956)\n \"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"WinXCorners\" - (UID: 00000000-00002956)\n \"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"Access violation at address 005FDB1F in module 'WinXCorners.exe'. Read of address 000003CC.\" - (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"GetWindowTextW\" (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"WinXCorners\" - (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"Access violation at address 005FDB1F in module 'WinXCorners.exe'. Read of address 000003CC.\" - (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"GetWindowTextW\" (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"WinXCorners\" - (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetWindowTextW\" with parameter \"Access violation at address 005FDB1F in module 'WinXCorners.exe'. Read of address 000003CC.\" - (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-150","type":6,"relevance":5,"name":"Calls an API typically used to get handle of currently active window","description":"\"WinXCorners.exe\" called \"GetActiveWindow\" (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"GetActiveWindow\" (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"GetActiveWindow\" (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"WinXCorners.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002956)\n \"WinXCorners.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$2b","description_v2":["\"WinXCorners.exe\" called \"RtlGetVersion\" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000080000000000000006523004600221f0001000000000000000a00280008000000d8df1e00d8df1e00d3df1e00000000000000000000001c0000000001b4fc12000000000020ff120095e13f774c4f0700feffffff435c437750594377c0010000c8010000d2df1e00d0df1e0054fe12000000000058fe1200000000004096437780a0567718fe1200d89c1e000000000000000000000000000000000018fe120054fe1200d8df1e00ff2b4377118f4000100dbd01398a400001000000a062400000000000fa88400018fe12006a010000ffffffff100dbd01 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"RtlGetVersion\" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000366afeffffffcd75477564561f77d40000009c504277e26b4775d4000000d40000008cfe1200b0ea1e77d4000000d400000000ff120035c2df68d40000006a01000044c2df68150016000d0000000000000000000000000000000000000000000000000000000000000000000000433a5c30463738423935362d393039442d343542322d384238442d321c5c427743794775ffffffff0c0000004c6242771f794775ffffffff0c00000010ff120004000000a03f8e000380000034ff12008df142000280000095f1420047000000028000000000b2750000721360ff1200e8a95300 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"RtlGetVersion\" (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"RtlGetVersion\" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001e00e06a1c003200020001000000f40100000a0000000000000000000000204b1e00c201000009000000a86f1c00050000000000000032000000a896200088f21200cc414477c88e200028000000fc000000ff2b4377ecaf5677e055ed73ac011c0000001c0031000700010000000000ffff2c060000040000000100000032000200010000000300000001000000f06d1c0028f31200f06d1c00f807000020000000784a1e0000000000184b1e00e06a1c00006c1c00e08e2000a86f1c000000dc0004f2120095e13f77f8f3120095e13f77000000004cf31200a86cdc00dcf21200 (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"RtlGetVersion\" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000080000000000000006523004600221f0001000000000000000a00280008000000d8df1e00d8df1e00d3df1e00000000000000000000001c0000000001b4fc12000000000020ff120095e13f774c4f0700feffffff435c437750594377c0010000c8010000d2df1e00d0df1e0054fe12000000000058fe1200000000004096437780a0567718fe1200d89c1e000000000000000000000000000000000018fe120054fe1200d8df1e00ff2b4377118f4000100dbd01398a400001000000a062400000000000fa88400018fe12006a010000ffffffff100dbd01 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"RtlGetVersion\" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000366afeffffffcd75477564561f77d40000009c504277e26b4775d4000000d40000008cfe1200b0ea1e77d4000000d400000000ff120035c2df68d40000006a01000044c2df68150016000d0000000000000000000000000000000000000000000000000000000000000000000000433a5c30463738423935362d393039442d343542322d384238442d321c5c427743794775ffffffff0c0000004c6242771f794775ffffffff0c00000010ff120004000000a03f8e000380000034ff12008df142000280000095f1420047000000028000000000b2750000721360ff1200e8a95300 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"RtlGetVersion\" (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"RtlGetVersion\" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001e00e06a1c003200020001000000f40100000a0000000000000000000000204b1e00c201000009000000a86f1c00050000000000000032000000a896200088f21200cc414477c88e200028000000fc000000ff2b4377ecaf5677e055ed73ac011c0000001c0031000700010000000000ffff2c060000040000000100000032000200010000000300000001000000f06d1c0028f31200f06d1c00f807000020000000784a1e0000000000184b1e00e06a1c00006c1c00e08e2000a86f1c000000dc0004f2120095e13f77f8f3120095e13f77000000004cf31200a86cdc00dcf21200 (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-144","type":6,"relevance":3,"name":"Calls an API typically used to open an existing named mutex object","description":"\"WinXCorners.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-222","type":6,"relevance":2,"name":"Calls an API typically used to retrieve OS information","description":"$2c","description_v2":["\"WinXCorners.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47d173b05320008c47d17300000000b0532000c4fe1200086d437718814b7700000000f8a58f000000000016e4241f04ff120095e13f77a44c0700feffffff6b2c447731194875021000000000000000000100d8fe1200c89f43778c47d1730000000000000000 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efefeb739063441c0200000044c7eb7300001300aecaeb73dc6cdc00a86cdc0038f3120000000000f8f3120044d6ec730c7fbd6ffeffffffefefeb736defeb73aecaeb738cf3120090e8eb73aecaeb7367c173752875ed73a8f31200c2c6eb732875ed7300000000d8f4120000000000 (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47d173b05320008c47d17300000000b0532000c4fe1200086d437718814b7700000000f8a58f000000000016e4241f04ff120095e13f77a44c0700feffffff6b2c447731194875021000000000000000000100d8fe1200c89f43778c47d1730000000000000000 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efefeb739063441c0200000044c7eb7300001300aecaeb73dc6cdc00a86cdc0038f3120000000000f8f3120044d6ec730c7fbd6ffeffffffefefeb736defeb73aecaeb738cf3120090e8eb73aecaeb7367c173752875ed73a8f31200c2c6eb732875ed7300000000d8f4120000000000 (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-148","type":6,"relevance":3,"name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WinXCorners.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002956)\n \"WinXCorners.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-147","type":6,"relevance":3,"name":"Calls an API typically used to retrieve local language","description":"\"WinXCorners.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002956)\n \"WinXCorners.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-450","type":2,"relevance":1,"name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-193","type":2,"relevance":1,"name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"WinXCorners.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"WinXCorners.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-326","type":2,"relevance":1,"name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Size Exceeded.\" (Indicator: \"set \"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found string \"Set Size Exceeded.\" (Indicator: \"set \"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found string \"Set Size Exceeded.\" (Indicator: \"set \"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","description_v2":["Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"$2d","description_v2":["Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"105204916995,3796,109,,GetWindowTextW,user32.dll,\"252:03:28.203\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002956.00000001.68750.001C0000.00000004.mdmp\")","Found reference to API \"421030074643,3796,105,,GetForegroundWindow,user32.dll,\"252:05:57.187\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002956.00000003.78288.001C0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"105204916995,3796,109,,GetWindowTextW,user32.dll,\"252:03:28.203\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002956.00000001.68750.001C0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"421030074643,3796,105,,GetForegroundWindow,user32.dll,\"252:05:57.187\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002956.00000003.78288.001C0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","description_v2":["Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-324","type":2,"relevance":1,"name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","description_v2":["\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"],"description_v3":[{"type":"text","value":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-138","type":3,"relevance":1,"name":"Queries for Borland Delphi related registry entry","description":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","description_v2":["\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-265","type":6,"relevance":1,"name":"Calls an API during runtime","description":"$2e","description_v2":["\"WinXCorners.exe\" called \"GetNativeSystemInfo\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetLocaleInfoW\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"RtlGetVersion\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadResource\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"CreateToolhelp32Snapshot\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"RtlGetNtProductType\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LookupAccountSidW\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"CreateCompatibleBitmap\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"FindResourceW\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetActiveWindow\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"EnumWindows\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetWindowTextW\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"OpenMutexW\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"IsWow64Process\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetForegroundWindow\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQueryInformationProcess\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQuerySystemInformation\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtAllocateVirtualMemory\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenDirectoryObject\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQueryVolumeInformationFile\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenSection\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtMapViewOfSection\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtDelayExecution\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtProtectVirtualMemory\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtCreateSection\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtConnectPort\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtRequestWaitReplyPort\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenProcessToken\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQueryInformationToken\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQueryAttributesFile\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtSetInformationProcess\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtUnmapViewOfSection\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtCreateMutant\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtCreateEvent\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtDeviceIoControlFile\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQueryVirtualMemory\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenFile\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQuerySystemTime\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtAlpcSendWaitReceivePort\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtCreateThreadEx\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtResumeThread\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtAlertThread\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenEvent\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenThreadToken\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtWaitForMultipleObjects\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenMutant\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtCreateFile\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenKeyEx\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQueryValueKey\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQueryInformationFile\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtEnumerateValueKey\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LdrGetDllHandle\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LdrGetProcedureAddress\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LdrLoadDll\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"FindWindowExW\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LdrUnloadDll\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"RpcStringBindingComposeW\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtReadFile\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtQueryKey\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtEnumerateKey\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetVersionExA\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtOpenProcess\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"NtTerminateProcess\" (PID: 2956) (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetKeyState\" (PID: 2956) (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"GetNativeSystemInfo\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetLocaleInfoW\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"RtlGetVersion\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadResource\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"CreateToolhelp32Snapshot\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"RtlGetNtProductType\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LookupAccountSidW\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"CreateCompatibleBitmap\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"FindResourceW\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetActiveWindow\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"EnumWindows\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetWindowTextW\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"OpenMutexW\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"IsWow64Process\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetForegroundWindow\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQueryInformationProcess\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQuerySystemInformation\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtAllocateVirtualMemory\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenDirectoryObject\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQueryVolumeInformationFile\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenSection\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtMapViewOfSection\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtDelayExecution\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtProtectVirtualMemory\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtCreateSection\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtConnectPort\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtRequestWaitReplyPort\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenProcessToken\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQueryInformationToken\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQueryAttributesFile\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtSetInformationProcess\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtUnmapViewOfSection\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtCreateMutant\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtCreateEvent\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtDeviceIoControlFile\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQueryVirtualMemory\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenFile\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQuerySystemTime\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtAlpcSendWaitReceivePort\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtCreateThreadEx\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtResumeThread\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtAlertThread\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenEvent\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenThreadToken\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtWaitForMultipleObjects\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenMutant\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtCreateFile\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenKeyEx\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQueryValueKey\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQueryInformationFile\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtEnumerateValueKey\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LdrGetDllHandle\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LdrGetProcedureAddress\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LdrLoadDll\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"FindWindowExW\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LdrUnloadDll\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"RpcStringBindingComposeW\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtReadFile\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtQueryKey\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtEnumerateKey\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetVersionExA\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtOpenProcess\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"NtTerminateProcess\" (PID: 2956) (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetKeyState\" (PID: 2956) (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$2f","description_v2":["\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter Msctf.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\uxtheme.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter wtsapi32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter WINSTA.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter RPCRT4.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter uxtheme.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter gdiplus.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter security.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter comctl32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\DUser.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter dwmapi.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\xmllite.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ole32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\MSCTF.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter comctl32 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter UxTheme.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter DUser.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter imageres.dll (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter Msctf.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\uxtheme.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter wtsapi32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter WINSTA.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter RPCRT4.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter uxtheme.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter gdiplus.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter security.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter comctl32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\DUser.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter dwmapi.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\xmllite.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ole32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\MSCTF.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter comctl32 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter UxTheme.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter DUser.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"LoadLibrary\" with a parameter imageres.dll (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$30","description_v2":["\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VariantChangeTypeEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarNeg (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarNot (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarAdd (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarSub (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarMul (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarDiv (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarIdiv (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarMod (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarAnd (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarOr (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarXor (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarCmp (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarI4FromStr (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarR4FromStr (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarR8FromStr (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarDateFromStr (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarCyFromStr (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarBoolFromStr (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarBstrFromCy (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarBstrFromDate (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoInitializeEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoAddRefServerProcess (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoReleaseServerProcess (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoResumeClassObjects (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoSuspendClassObjects (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ThemeInitApiHook (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsProcessDPIAware (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WTSRegisterSessionNotification (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsWindow (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WinStationRegisterConsoleNotification (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter LookupAccountSidLocalW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateWellKnownSid (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcStringBindingComposeW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcStringFreeW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter NdrClientCall2 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter NdrAsyncClientCall (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetLayout (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GdiRealizationInfo (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FontIsLinked (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetFontAssocStatus (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExA (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyExW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetTextFaceAliasW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AnimateWindow (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitializeFlatSB (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter UninitializeFlatSB (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollProp (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollProp (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollRange (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollPos (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollPos (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollRange (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetWindowInfo (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetAncestor (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetMonitorInfoA (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EnumDisplayMonitors (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EnumDisplayDevicesA (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ExtTextOutW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetFileSizeEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CloseThemeData (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter HitTestThemeBackground (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeEdge (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeIcon (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsThemePartDefined (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeColor (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeMetric (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeString (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeBool (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeInt (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeEnumValue (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemePosition (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeFont (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeRect (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeMargins (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeIntList (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemePropertyOrigin (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetWindowTheme (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeFilename (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysColor (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysColorBrush (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeAppProperties (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetThemeAppProperties (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetCurrentThemeName (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeParentBackground (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EnableTheming (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitCommonControlsEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter TaskDialogIndirect (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlInitUnicodeString (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitGadgets (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegisterMessagePumpHook (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsThemeActive (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateGadget (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetMessageFilter (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetStyle (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetRootInfo (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateStreamOnHGlobal (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateXmlReader (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FindStdColor (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AttachWndProcW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetGadgetTicket (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegisterClassNameW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EnableThemeDialogTexture (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InvalidateGadget (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetGadgetFocus (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeTextExtent (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundExtent (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoUninitialize (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetFocus (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ForwardGadgetMessage (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarBstrFromBool (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter LookupAccountSidW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BufferedPaintInit (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKeyW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegEnumValueW (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GdiplusStartup (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawShadowText (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawSizeBox (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawScrollBar (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SizeBoxHwnd (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ScrollBar_MouseMove (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ScrollBar_Menu (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter HandleScrollCmd (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DetachScrollBars (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AttachScrollBars (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CCSetScrollInfo (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CCGetScrollInfo (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CCEnableScrollBar (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter QuerySystemGestureStatus (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BufferedPaintUnInit (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter OpenThemeData (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeBackground (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeText (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemePartSize (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeTextMetrics (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysBool (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysSize (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysFont (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysString (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysInt (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsAppThemed (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetWindowTheme (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EventWrite (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EventRegister (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EventUnregister (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetGadgetRgn (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DUserSendEvent (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetRect (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeTransitionDuration (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BeginBufferedAnimation (UID: 00000000-00002956)","\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EndBufferedAnimation (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VariantChangeTypeEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarNeg (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarNot (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarAdd (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarSub (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarMul (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarDiv (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarIdiv (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarMod (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarAnd (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarOr (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarXor (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarCmp (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarI4FromStr (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarR4FromStr (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarR8FromStr (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarDateFromStr (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarCyFromStr (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarBoolFromStr (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarBstrFromCy (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarBstrFromDate (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoInitializeEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoAddRefServerProcess (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoReleaseServerProcess (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoResumeClassObjects (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoSuspendClassObjects (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ThemeInitApiHook (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsProcessDPIAware (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WTSRegisterSessionNotification (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsWindow (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WinStationRegisterConsoleNotification (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter LookupAccountSidLocalW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateWellKnownSid (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcStringBindingComposeW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcStringFreeW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter NdrClientCall2 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter NdrAsyncClientCall (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetLayout (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GdiRealizationInfo (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FontIsLinked (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetFontAssocStatus (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExA (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyExW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetTextFaceAliasW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AnimateWindow (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitializeFlatSB (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter UninitializeFlatSB (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollProp (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollProp (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollRange (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollPos (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollPos (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollRange (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetWindowInfo (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetAncestor (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetMonitorInfoA (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EnumDisplayMonitors (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EnumDisplayDevicesA (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ExtTextOutW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetFileSizeEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CloseThemeData (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter HitTestThemeBackground (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeEdge (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeIcon (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsThemePartDefined (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeColor (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeMetric (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeString (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeBool (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeInt (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeEnumValue (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemePosition (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeFont (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeRect (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeMargins (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeIntList (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemePropertyOrigin (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetWindowTheme (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeFilename (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysColor (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysColorBrush (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeAppProperties (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetThemeAppProperties (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetCurrentThemeName (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeParentBackground (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EnableTheming (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitCommonControlsEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter TaskDialogIndirect (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlInitUnicodeString (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitGadgets (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegisterMessagePumpHook (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsThemeActive (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateGadget (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetMessageFilter (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetStyle (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetRootInfo (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateStreamOnHGlobal (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateXmlReader (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FindStdColor (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AttachWndProcW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetGadgetTicket (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegisterClassNameW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EnableThemeDialogTexture (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InvalidateGadget (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetGadgetFocus (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeTextExtent (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundExtent (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoUninitialize (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetFocus (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ForwardGadgetMessage (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter VarBstrFromBool (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter LookupAccountSidW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BufferedPaintInit (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKeyW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegEnumValueW (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GdiplusStartup (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawShadowText (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawSizeBox (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawScrollBar (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SizeBoxHwnd (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ScrollBar_MouseMove (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter ScrollBar_Menu (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter HandleScrollCmd (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DetachScrollBars (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter AttachScrollBars (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CCSetScrollInfo (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CCGetScrollInfo (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter CCEnableScrollBar (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter QuerySystemGestureStatus (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BufferedPaintUnInit (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter OpenThemeData (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeBackground (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DrawThemeText (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemePartSize (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeTextMetrics (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysBool (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysSize (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysFont (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysString (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeSysInt (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter IsAppThemed (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetWindowTheme (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EventWrite (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EventRegister (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EventUnregister (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetGadgetRgn (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter DUserSendEvent (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter SetGadgetRect (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter GetThemeTransitionDuration (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter BeginBufferedAnimation (UID: 00000000-00002956)"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" called \"GetProcAddress\" with a parameter EndBufferedAnimation (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-16","type":2,"relevance":2,"name":"Contains SQL queries","description":"$31","description_v2":["\"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear.\"), \"Select Your Connection}Select your connection from the list. The connection must have a saved user name and password","and be available to all users.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your connection}select your connection from the list. the connection must have a saved user name and password","and be available to all users.\"), \"Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed","select Not Listed at the bottom of the list.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed","select not listed at the bottom of the list.\"), \"Select the appropriate display resolution from the list below. For best results","use the resolution recommended by the manufacturer in the display hardware documentation.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select the appropriate display resolution from the list below. for best results","use the resolution recommended by the manufacturer in the display hardware documentation.\"), \"insert it into the digital tuner and select Scan Again.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"insert it into the digital tuner and select scan again.\"), \"Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel","select Add DTV Channel.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel","$32","\"Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?\")"],"description_v3":[{"type":"text","value":"\"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear.\"), \"Select Your Connection}Select your connection from the list. The connection must have a saved user name and password"},{"type":"linebreak"},{"type":"text","value":"and be available to all users.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your connection}select your connection from the list. the connection must have a saved user name and password"},{"type":"linebreak"},{"type":"text","value":"and be available to all users.\"), \"Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed"},{"type":"linebreak"},{"type":"text","value":"select Not Listed at the bottom of the list.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed"},{"type":"linebreak"},{"type":"text","value":"select not listed at the bottom of the list.\"), \"Select the appropriate display resolution from the list below. For best results"},{"type":"linebreak"},{"type":"text","value":"use the resolution recommended by the manufacturer in the display hardware documentation.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select the appropriate display resolution from the list below. for best results"},{"type":"linebreak"},{"type":"text","value":"use the resolution recommended by the manufacturer in the display hardware documentation.\"), \"insert it into the digital tuner and select Scan Again.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"insert it into the digital tuner and select scan again.\"), \"Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel"},{"type":"linebreak"},{"type":"text","value":"select Add DTV Channel.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel"},{"type":"linebreak"},{"type":"text","value":"$33"},{"type":"linebreak"},{"type":"text","value":"\"Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-79","type":0,"relevance":1,"name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin)","description_v2":["Found GetProcAddress() and LoadLibraryA() in an import section (Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin)"],"description_v3":[{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin)"}],"origin":"Static Parser","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$34","description_v2":["Found reference to API (Indicator: \"GetLogicalProcessorInformation\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetThreadPreferredUILanguages\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"SetThreadPreferredUILanguages\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetThreadUILanguage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetLongPathNameW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"SetEvent\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"ResetEvent\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetObject\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"Sleep\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetSystemTimes\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetTickCount\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"InitializeConditionVariable\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WakeConditionVariable\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WakeAllConditionVariable\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"SleepConditionVariableCS\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"CoInitializeEx\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"AnimateWindow\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"IsWow64Process\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetTickCount64\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAStartup\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSACleanup\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"closesocket\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"ioctlsocket\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"getpeername\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"getsockname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"getsockopt\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"htonl\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"htons\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"inet_addr\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"inet_ntoa\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"ntohl\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"ntohs\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"recvfrom\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"gethostbyaddr\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"gethostbyname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"gethostname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"getservbyport\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"getservbyname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"getprotobynumber\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"getprotobyname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSASetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAGetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAsyncGetServByName\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAsyncGetServByPort\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAsyncGetProtoByName\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAsyncGetProtoByNumber\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAsyncGetHostByName\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAsyncGetHostByAddr\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSACancelAsyncRequest\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAsyncSelect\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"__WSAFDIsSet\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAGetOverlappedResult\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAIoctl\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSASocketA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAddressToStringA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAAddressToStringW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAStringToAddressA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAStringToAddressW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSALookupServiceBeginA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSALookupServiceBeginW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSALookupServiceNextA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSALookupServiceNextW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSALookupServiceEnd\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAInstallServiceClassA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAInstallServiceClassW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSARemoveServiceClass\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAGetServiceClassInfoA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAGetServiceClassInfoW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAGetServiceClassNameByClassIdA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSAGetServiceClassNameByClassIdW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSASetServiceA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSASetServiceW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"TransmitFile\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetAcceptExSockaddrs\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"AcceptEx\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"WSARecvEx\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"IdnToUnicode\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"IdnToNameprepUnicode\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"IdnToAscii\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"IsNormalizedString\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"NormalizeString\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetIpAddrTable\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetUniDirectionalAdapterInfo\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetAdaptersInfo\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetAdaptersAddresses\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"EncryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"DecryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"FreeContextBuffer\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"AcquireCredentialsHandleW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"FreeCredentialsHandle\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"InitializeSecurityContextW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"DeleteSecurityContext\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API (Indicator: \"Shell_NotifyIconW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShellExecuteW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CopyImage\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateWindowExW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetMenuItemInfoW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetMenuItemInfoW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetDCEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"PeekMessageW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetTimer\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"WindowFromPoint\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"BeginPaint\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"FrameRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"OffsetRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"FillRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetMenuStringW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DispatchMessageW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateAcceleratorTableW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SendMessageA\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnumWindows\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShowOwnedPopups\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSystemMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetScrollRange\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetScrollPos\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetScrollPos\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetActiveWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetActiveWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawEdge\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"InflateRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetKeyboardLayoutList\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawFocusRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnumChildWindows\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ReleaseCapture\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"UnhookWindowsHookEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"LoadCursorW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetCapture\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetCapture\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreatePopupMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ScrollWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShowCaret\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetMenuItemID\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetLastActivePopup\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharLowerBuffW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawMenuBar\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetParent\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsZoomed\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharUpperBuffW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetClientRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsChild\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ClientToScreen\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetClipboardData\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetClipboardData\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetWindowPlacement\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsIconic\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CallNextHookEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShowWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CheckMenuItem\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharUpperW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DefWindowProcW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetForegroundWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetWindowTextW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnableWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DestroyWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"RegisterClassW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharNextW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"RedrawWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetDC\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetFocus\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetFocus\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ReleaseDC\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MsgWaitForMultipleObjectsEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ActivateKeyboardLayout\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetParent\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetScrollRange\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"InsertMenuItemW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"PeekMessageA\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MessageBoxW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MessageBeep\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"UpdateWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSubMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MsgWaitForMultipleObjects\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DestroyMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DestroyIcon\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EmptyClipboard\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsWindowVisible\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DispatchMessageA\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"UnregisterClassW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetTopWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"AdjustWindowRectEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawIcon\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnumThreadWindows\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"InvalidateRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetKeyboardState\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawFrameControl\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ScreenToClient\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetCursor\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateIcon\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"LoadStringW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharLowerW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetWindowPos\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetWindowRgn\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetMenuItemCount\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"RemoveMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSysColorBrush\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetWindowDC\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"TranslateMessage\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"OpenClipboard\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MapWindowPoints\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CloseClipboard\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DestroyCursor\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetScrollInfo\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetWindowTextW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"UpdateLayeredWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnableScrollBar\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSysColor\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"TrackPopupMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CopyIcon\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawIconEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"PostQuitMessage\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShowScrollBar\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnableMenuItem\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetIconInfo\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"Shell_NotifyIconW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShellExecuteW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CopyImage\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateWindowExW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetMenuItemInfoW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetMenuItemInfoW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetDCEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"PeekMessageW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetTimer\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"WindowFromPoint\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"BeginPaint\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"FrameRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"OffsetRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"FillRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetMenuStringW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DispatchMessageW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateAcceleratorTableW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SendMessageA\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnumWindows\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShowOwnedPopups\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSystemMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetScrollRange\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetScrollPos\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetScrollPos\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetActiveWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawEdge\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"InflateRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawFocusRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnumChildWindows\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ReleaseCapture\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"UnhookWindowsHookEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"LoadCursorW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetCapture\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetCapture\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreatePopupMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ScrollWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShowCaret\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetMenuItemID\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetLastActivePopup\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharLowerBuffW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawMenuBar\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetParent\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsZoomed\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharUpperBuffW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetClientRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsChild\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ClientToScreen\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetClipboardData\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetClipboardData\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetWindowPlacement\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsIconic\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CallNextHookEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CheckMenuItem\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharUpperW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetForegroundWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetWindowTextW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnableWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DestroyWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"RegisterClassW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharNextW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"RedrawWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetDC\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetFocus\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetFocus\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ReleaseDC\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MsgWaitForMultipleObjectsEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ActivateKeyboardLayout\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetParent\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetScrollRange\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"InsertMenuItemW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"PeekMessageA\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MessageBoxW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MessageBeep\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"UpdateWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSubMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MsgWaitForMultipleObjects\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DestroyMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DestroyIcon\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EmptyClipboard\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsWindowVisible\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DispatchMessageA\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"UnregisterClassW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetTopWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"AdjustWindowRectEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawIcon\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"IsWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnumThreadWindows\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"InvalidateRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawFrameControl\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ScreenToClient\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetCursor\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateIcon\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"LoadStringW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CharLowerW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetWindowPos\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetWindowRgn\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetMenuItemCount\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"RemoveMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSysColorBrush\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetWindowDC\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"TranslateMessage\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"OpenClipboard\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"MapWindowPoints\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CloseClipboard\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DestroyCursor\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetScrollInfo\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"SetWindowTextW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"UpdateLayeredWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnableScrollBar\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetSysColor\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"TrackPopupMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"CopyIcon\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"DrawIconEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"PostQuitMessage\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"ShowScrollBar\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"EnableMenuItem\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"GetIconInfo\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalProcessorInformation\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadPreferredUILanguages\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadPreferredUILanguages\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadUILanguage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLongPathNameW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ResetEvent\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetObject\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimes\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeConditionVariable\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeConditionVariable\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeAllConditionVariable\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableCS\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitializeEx\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AnimateWindow\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWow64Process\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount64\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStartup\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSACleanup\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"closesocket\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ioctlsocket\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getpeername\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getsockname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getsockopt\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"htonl\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"htons\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"inet_addr\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"inet_ntoa\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ntohl\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ntohs\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"recvfrom\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"gethostbyaddr\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"gethostbyname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"gethostname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getservbyport\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getservbyname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getprotobynumber\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getprotobyname\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSASetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAsyncGetServByName\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAsyncGetServByPort\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAsyncGetProtoByName\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAsyncGetProtoByNumber\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAsyncGetHostByName\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAsyncGetHostByAddr\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSACancelAsyncRequest\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAsyncSelect\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"__WSAFDIsSet\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetOverlappedResult\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAIoctl\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSASocketA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAddressToStringA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAAddressToStringW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStringToAddressA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStringToAddressW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSALookupServiceBeginA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSALookupServiceBeginW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSALookupServiceNextA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSALookupServiceNextW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSALookupServiceEnd\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAInstallServiceClassA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAInstallServiceClassW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSARemoveServiceClass\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetServiceClassInfoA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetServiceClassInfoW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetServiceClassNameByClassIdA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetServiceClassNameByClassIdW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSASetServiceA\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSASetServiceW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TransmitFile\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetAcceptExSockaddrs\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcceptEx\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSARecvEx\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IdnToUnicode\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IdnToNameprepUnicode\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IdnToAscii\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsNormalizedString\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NormalizeString\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetIpAddrTable\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUniDirectionalAdapterInfo\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetAdaptersInfo\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetAdaptersAddresses\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecryptMessage\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeContextBuffer\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireCredentialsHandleW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeCredentialsHandle\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSecurityContextW\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteSecurityContext\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Shell_NotifyIconW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyImage\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWindowExW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenuItemInfoW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetMenuItemInfoW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDCEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekMessageW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetTimer\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WindowFromPoint\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BeginPaint\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FrameRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OffsetRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FillRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenuStringW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DispatchMessageW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateAcceleratorTableW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SendMessageA\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumWindows\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowOwnedPopups\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetScrollRange\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetScrollPos\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetScrollPos\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetActiveWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetActiveWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawEdge\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InflateRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardLayoutList\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawFocusRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumChildWindows\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseCapture\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhookWindowsHookEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadCursorW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCapture\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCapture\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePopupMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ScrollWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowCaret\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenuItemID\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastActivePopup\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharLowerBuffW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawMenuBar\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetParent\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsZoomed\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharUpperBuffW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClientRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsChild\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ClientToScreen\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClipboardData\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetClipboardData\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPlacement\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsIconic\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CallNextHookEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CheckMenuItem\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharUpperW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DefWindowProcW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetForegroundWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterClassW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharNextW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RedrawWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDC\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFocus\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFocus\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseDC\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MsgWaitForMultipleObjectsEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ActivateKeyboardLayout\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetParent\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetScrollRange\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InsertMenuItemW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekMessageA\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBeep\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UpdateWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSubMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MsgWaitForMultipleObjects\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyIcon\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EmptyClipboard\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWindowVisible\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DispatchMessageA\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterClassW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTopWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AdjustWindowRectEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawIcon\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumThreadWindows\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InvalidateRect\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardState\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawFrameControl\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ScreenToClient\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursor\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIcon\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadStringW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharLowerW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPos\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowRgn\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenuItemCount\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RemoveMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSysColorBrush\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowDC\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TranslateMessage\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenClipboard\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapWindowPoints\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseClipboard\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyCursor\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetScrollInfo\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowTextW\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UpdateLayeredWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableScrollBar\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSysColor\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TrackPopupMenu\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyIcon\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawIconEx\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQuitMessage\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowScrollBar\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableMenuItem\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetIconInfo\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Shell_NotifyIconW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyImage\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWindowExW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenuItemInfoW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetMenuItemInfoW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDCEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekMessageW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetTimer\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WindowFromPoint\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BeginPaint\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FrameRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OffsetRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FillRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenuStringW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DispatchMessageW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateAcceleratorTableW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SendMessageA\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumWindows\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowOwnedPopups\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetScrollRange\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetScrollPos\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetScrollPos\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetActiveWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawEdge\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InflateRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawFocusRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumChildWindows\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseCapture\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhookWindowsHookEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadCursorW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCapture\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCapture\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePopupMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ScrollWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowCaret\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenuItemID\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastActivePopup\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharLowerBuffW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawMenuBar\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetParent\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsZoomed\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharUpperBuffW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClientRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsChild\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ClientToScreen\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClipboardData\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetClipboardData\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPlacement\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsIconic\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CallNextHookEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CheckMenuItem\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharUpperW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetForegroundWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterClassW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharNextW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RedrawWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDC\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFocus\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFocus\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseDC\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MsgWaitForMultipleObjectsEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ActivateKeyboardLayout\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetParent\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetScrollRange\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InsertMenuItemW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekMessageA\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBeep\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UpdateWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSubMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MsgWaitForMultipleObjects\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyIcon\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EmptyClipboard\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWindowVisible\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DispatchMessageA\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterClassW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTopWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AdjustWindowRectEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawIcon\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumThreadWindows\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InvalidateRect\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawFrameControl\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ScreenToClient\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursor\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIcon\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadStringW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharLowerW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPos\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowRgn\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenuItemCount\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RemoveMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSysColorBrush\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowDC\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TranslateMessage\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenClipboard\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapWindowPoints\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseClipboard\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyCursor\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetScrollInfo\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowTextW\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UpdateLayeredWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableScrollBar\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSysColor\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TrackPopupMenu\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyIcon\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawIconEx\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQuitMessage\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowScrollBar\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableMenuItem\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetIconInfo\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","description_v2":["Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","description_v2":["Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-78","type":0,"relevance":1,"name":"Contains export functions","description":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"TMethodImplementationIntercept\" at ordinal 3\n \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"__dbk_fcall_wrapper\" at ordinal 2\n \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"dbkFCallWrapperAddr\" at ordinal 1","description_v2":["\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"TMethodImplementationIntercept\" at ordinal 3","\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"__dbk_fcall_wrapper\" at ordinal 2","\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"dbkFCallWrapperAddr\" at ordinal 1"],"description_v3":[{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"TMethodImplementationIntercept\" at ordinal 3"},{"type":"linebreak"},{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"__dbk_fcall_wrapper\" at ordinal 2"},{"type":"linebreak"},{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" contains export function called \"dbkFCallWrapperAddr\" at ordinal 1"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$35","description_v2":["\"Software\\Embarcadero\\Locales\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"Software\\CodeGear\\Locales\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"Software\\Borland\\Locales\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"Software\\Borland\\Delphi\\Locales\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin","\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000000.66828.7F6F0000.00000002.mdmp","00000000-00002956.00000001.68750.7F6F0000.00000002.mdmp","00000000-00002956.00000002.70669.7F6F0000.00000002.mdmp","00000000-00002956.00000003.78288.7F6F0000.00000002.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\Embarcadero\\Locales\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"Software\\CodeGear\\Locales\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Borland\\Locales\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Borland\\Delphi\\Locales\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000000.66828.7F6F0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.7F6F0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.7F6F0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.7F6F0000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-22","type":6,"relevance":1,"name":"Fails to load modules at runtime","description":"\"WinXCorners.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"WinXCorners.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","description_v2":["\"WinXCorners.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]","\"WinXCorners.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]"}],"origin":"API Call","attck_id":"T1574.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"memorydump-10","type":20,"relevance":1,"name":"Found registry location strings in memory","description":"\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000000.66828.7F6F0000.00000002.mdmp\n \"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000001.68750.7F6F0000.00000002.mdmp\n \"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000002.70669.7F6F0000.00000002.mdmp\n \"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000003.78288.7F6F0000.00000002.mdmp","description_v2":["\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000000.66828.7F6F0000.00000002.mdmp","\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000001.68750.7F6F0000.00000002.mdmp","\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000002.70669.7F6F0000.00000002.mdmp","\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000003.78288.7F6F0000.00000002.mdmp"],"description_v3":[{"type":"text","value":"\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000000.66828.7F6F0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000001.68750.7F6F0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000002.70669.7F6F0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002956.00000003.78288.7F6F0000.00000002.mdmp"}],"origin":"Memory Dumps","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-13","type":10,"relevance":1,"name":"Loaded EXE module from outside of Windows folder","description":"\"WinXCorners.exe\" loaded module \"C:\\WinXCorners.exe\" at 00400000","description_v2":["\"WinXCorners.exe\" loaded module \"C:\\WinXCorners.exe\" at 00400000"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" loaded module \"C:\\WinXCorners.exe\" at 00400000"}],"origin":"Loaded Module","attck_id":"T1574","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1574","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-11","type":10,"relevance":0,"name":"Loaded modules","description":"$36","description_v2":["\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\ntdll.dll\" at 773E0000","\"WinXCorners.exe\" loaded module \"C:\\WinXCorners.exe\" at 00400000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\kernel32.dll\" at 771A0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\KernelBase.dll\" at 75470000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\winspool.drv\" at 71960000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\msvcrt.dll\" at 75730000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\gdi32.dll\" at 77540000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\user32.dll\" at 759B0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\lpk.dll\" at 757E0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\usp10.dll\" at 77590000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\" at 74130000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\shlwapi.dll\" at 75690000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\shell32.dll\" at 76400000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\version.dll\" at 74860000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\oleaut32.dll\" at 77100000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\ole32.dll\" at 77280000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75DD0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\advapi32.dll\" at 77050000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\sechost.dll\" at 75670000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\netapi32.dll\" at 73830000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\netutils.dll\" at 742D0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\srvcli.dll\" at 74EE0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\wkscli.dll\" at 74100000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\winhttp.dll\" at 709E0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\webio.dll\" at 70990000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\imm32.dll\" at 00170000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\imm32.dll\" at 757F0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\msctf.dll\" at 75B20000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\WindowsShell.Manifest\" at 00190000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\Temp\\VxSSL32.dll\" at 68DF0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\ws2_32.dll\" at 75A80000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\nsi.dll\" at 77530000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\fltLib.dll\" at 70660000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\api-ms-win-core-synch-l1-2-0.dll\" at 72490000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73820000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\tzres.dll\" at 002C0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\uxtheme.dll\" at 73EE0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\wtsapi32.dll\" at 74780000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\winsta.dll\" at 75250000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\Fonts\\StaticCache.dat\" at 025A0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\en-US\\user32.dll.mui\" at 002F0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\GdiPlus.dll\" at 73BA0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\" at 03080000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\security.dll\" at 72330000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\secur32.dll\" at 75020000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\sspicli.dll\" at 75170000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\" at 00310000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\duser.dll\" at 73EB0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\xmllite.dll\" at 73A80000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\" at 00350000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\clbcatq.dll\" at 75E80000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\Temp\\VxOle32.dll\" at 68DA0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\cryptbase.dll\" at 751E0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\dwmapi.dll\" at 73AB0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\imageres.dll\" at 03620000"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\ntdll.dll\" at 773E0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"C:\\WinXCorners.exe\" at 00400000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\kernel32.dll\" at 771A0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\KernelBase.dll\" at 75470000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\winspool.drv\" at 71960000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\msvcrt.dll\" at 75730000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\gdi32.dll\" at 77540000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\user32.dll\" at 759B0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\lpk.dll\" at 757E0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\usp10.dll\" at 77590000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\" at 74130000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\shlwapi.dll\" at 75690000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\shell32.dll\" at 76400000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\version.dll\" at 74860000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\oleaut32.dll\" at 77100000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\ole32.dll\" at 77280000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75DD0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\advapi32.dll\" at 77050000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\sechost.dll\" at 75670000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\netapi32.dll\" at 73830000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\netutils.dll\" at 742D0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\srvcli.dll\" at 74EE0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\wkscli.dll\" at 74100000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\winhttp.dll\" at 709E0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\webio.dll\" at 70990000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\imm32.dll\" at 00170000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\imm32.dll\" at 757F0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\msctf.dll\" at 75B20000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\WindowsShell.Manifest\" at 00190000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\Temp\\VxSSL32.dll\" at 68DF0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\ws2_32.dll\" at 75A80000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\nsi.dll\" at 77530000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\fltLib.dll\" at 70660000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\api-ms-win-core-synch-l1-2-0.dll\" at 72490000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73820000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\tzres.dll\" at 002C0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\uxtheme.dll\" at 73EE0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\wtsapi32.dll\" at 74780000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\winsta.dll\" at 75250000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\Fonts\\StaticCache.dat\" at 025A0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\en-US\\user32.dll.mui\" at 002F0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\GdiPlus.dll\" at 73BA0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\" at 03080000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\security.dll\" at 72330000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\secur32.dll\" at 75020000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\sspicli.dll\" at 75170000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\" at 00310000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\duser.dll\" at 73EB0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\xmllite.dll\" at 73A80000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\" at 00350000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\clbcatq.dll\" at 75E80000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\Temp\\VxOle32.dll\" at 68DA0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\cryptbase.dll\" at 751E0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\dwmapi.dll\" at 73AB0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\imageres.dll\" at 03620000"}],"origin":"Loaded Module","attck_id":"T1574.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$37","description_v2":["\"WinXCorners.exe\" loaded module \"KERNEL32.DLL\" at base 771a0000","\"WinXCorners.exe\" loaded module \"MSCTF.DLL\" at base 75b20000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 73ee0000","\"WinXCorners.exe\" loaded module \"CRYPTBASE.DLL\" at base 751e0000","\"WinXCorners.exe\" loaded module \"WTSAPI32.DLL\" at base 74780000","\"WinXCorners.exe\" loaded module \"USER32.DLL\" at base 759b0000","\"WinXCorners.exe\" loaded module \"WINSTA.DLL\" at base 75250000","\"WinXCorners.exe\" loaded module \"ADVAPI32.DLL\" at base 77050000","\"WinXCorners.exe\" loaded module \"RPCRT4.DLL\" at base 75dd0000","\"WinXCorners.exe\" loaded module \"API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL\" at base 75670000","\"WinXCorners.exe\" loaded module \"UXTHEME.DLL\" at base 73ee0000","\"WinXCorners.exe\" loaded module \"GDIPLUS.DLL\" at base 73ba0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\WINSXS\\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\\GDIPLUS.DLL\" at base 73ba0000","\"WinXCorners.exe\" loaded module \"SECURITY.DLL\" at base 72330000","\"WinXCorners.exe\" loaded module \"COMCTL32.DLL\" at base 74130000","\"WinXCorners.exe\" loaded module \"NTDLL.DLL\" at base 773e0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\DUSER.DLL\" at base 73eb0000","\"WinXCorners.exe\" loaded module \"DWMAPI.DLL\" at base 73ab0000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\XMLLITE.DLL\" at base 73a80000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLE32.DLL\" at base 77280000","\"WinXCorners.exe\" loaded module \"CLBCATQ.DLL\" at base 75e80000","\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 75b20000","\"WinXCorners.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 72490000","\"WinXCorners.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0","\"WinXCorners.exe\" loaded module \"KERNEL32\" at base 771a0000","\"WinXCorners.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0","\"WinXCorners.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 68da0000","\"WinXCorners.exe\" loaded module \"IMM32.DLL\" at base 757f0000","\"WinXCorners.exe\" loaded module \"COMCTL32\" at base 74130000","\"WinXCorners.exe\" loaded module \"DUSER.DLL\" at base 73eb0000","\"WinXCorners.exe\" loaded module \"OLE32.DLL\" at base 77280000","\"WinXCorners.exe\" loaded module \"OLEAUT32.DLL\" at base 77100000"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" loaded module \"KERNEL32.DLL\" at base 771a0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"MSCTF.DLL\" at base 75b20000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 73ee0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"CRYPTBASE.DLL\" at base 751e0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"WTSAPI32.DLL\" at base 74780000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"USER32.DLL\" at base 759b0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"WINSTA.DLL\" at base 75250000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"ADVAPI32.DLL\" at base 77050000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"RPCRT4.DLL\" at base 75dd0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL\" at base 75670000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"UXTHEME.DLL\" at base 73ee0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"GDIPLUS.DLL\" at base 73ba0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\WINSXS\\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\\GDIPLUS.DLL\" at base 73ba0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"SECURITY.DLL\" at base 72330000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"COMCTL32.DLL\" at base 74130000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"NTDLL.DLL\" at base 773e0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\DUSER.DLL\" at base 73eb0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"DWMAPI.DLL\" at base 73ab0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\XMLLITE.DLL\" at base 73a80000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLE32.DLL\" at base 77280000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"CLBCATQ.DLL\" at base 75e80000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 75b20000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 72490000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"KERNEL32\" at base 771a0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 68da0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"IMM32.DLL\" at base 757f0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"COMCTL32\" at base 74130000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"DUSER.DLL\" at base 73eb0000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"OLE32.DLL\" at base 77280000"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" loaded module \"OLEAUT32.DLL\" at base 77100000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75DD0000","description_v2":["\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75DD0000"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75DD0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-8","type":6,"relevance":1,"name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cbae268@advapi32.dll\"\n \"0e000f00b4bae268@advapi32.dll\"\n \"0e000f00e8bae268@advapi32.dll\"\n \"1100120048bfe268@advapi32.dll\"\n \"11001200b4bfe268@advapi32.dll\"\n \"12001300c8bfe268@advapi32.dll\"\n \"12001300f0bfe268@advapi32.dll\"\n \"14001500b0d4e268@advapi32.dll\"\n \"14001500c8d4e268@advapi32.dll\"\n \"14001500e0d4e268@advapi32.dll\"\n \"17001800f8d4e268@advapi32.dll\"\n \"0d000e0010d5e268@advapi32.dll\"\n \"0f00100038d1e268@netapi32.dll\"\n \"0d000e0010c0e268@shell32.dll\"\n \"0d000e0064c0e268@shell32.dll\"\n \"0d000e003cd6e268@advapi32.dll\"\n \"140015007cd6e268@advapi32.dll\"\n \"1400150094d6e268@advapi32.dll\"\n \"0c000d00dcd6e268@advapi32.dll\"\n \"0c000d00ecd6e268@advapi32.dll\"\n \"0e000f00fcd6e268@advapi32.dll\"\n \"0e000f0004d8e268@winhttp.dll\"\n \"1200130024d8e268@winhttp.dll\"\n \"1200130038d8e268@winhttp.dll\"\n \"160017004cd8e268@winhttp.dll\"","description_v2":["\"150016003cbae268@advapi32.dll\"","\"0e000f00b4bae268@advapi32.dll\"","\"0e000f00e8bae268@advapi32.dll\"","\"1100120048bfe268@advapi32.dll\"","\"11001200b4bfe268@advapi32.dll\"","\"12001300c8bfe268@advapi32.dll\"","\"12001300f0bfe268@advapi32.dll\"","\"14001500b0d4e268@advapi32.dll\"","\"14001500c8d4e268@advapi32.dll\"","\"14001500e0d4e268@advapi32.dll\"","\"17001800f8d4e268@advapi32.dll\"","\"0d000e0010d5e268@advapi32.dll\"","\"0f00100038d1e268@netapi32.dll\"","\"0d000e0010c0e268@shell32.dll\"","\"0d000e0064c0e268@shell32.dll\"","\"0d000e003cd6e268@advapi32.dll\"","\"140015007cd6e268@advapi32.dll\"","\"1400150094d6e268@advapi32.dll\"","\"0c000d00dcd6e268@advapi32.dll\"","\"0c000d00ecd6e268@advapi32.dll\"","\"0e000f00fcd6e268@advapi32.dll\"","\"0e000f0004d8e268@winhttp.dll\"","\"1200130024d8e268@winhttp.dll\"","\"1200130038d8e268@winhttp.dll\"","\"160017004cd8e268@winhttp.dll\""],"description_v3":[{"type":"text","value":"\"150016003cbae268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0e000f00b4bae268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0e000f00e8bae268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"1100120048bfe268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"11001200b4bfe268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"12001300c8bfe268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"12001300f0bfe268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"14001500b0d4e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"14001500c8d4e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"14001500e0d4e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"17001800f8d4e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0d000e0010d5e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0f00100038d1e268@netapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0d000e0010c0e268@shell32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0d000e0064c0e268@shell32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0d000e003cd6e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"140015007cd6e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"1400150094d6e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0c000d00dcd6e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0c000d00ecd6e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0e000f00fcd6e268@advapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"0e000f0004d8e268@winhttp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"1200130024d8e268@winhttp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"1200130038d8e268@winhttp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"160017004cd8e268@winhttp.dll\""}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\"\n \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" was detected as \"Turbo Linker\" and name: \"Linker\"","description_v2":["\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\"","\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" was detected as \"Turbo Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" was detected as \"Turbo Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-605","type":2,"relevance":1,"name":"May execute SQL queries","description":"$38","description_v2":["\"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear.\"), \"Select Your Connection}Select your connection from the list. The connection must have a saved user name and password","and be available to all users.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your connection}select your connection from the list. the connection must have a saved user name and password","and be available to all users.\"), \"Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed","select Not Listed at the bottom of the list.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed","select not listed at the bottom of the list.\"), \"Select the appropriate display resolution from the list below. For best results","use the resolution recommended by the manufacturer in the display hardware documentation.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select the appropriate display resolution from the list below. for best results","use the resolution recommended by the manufacturer in the display hardware documentation.\"), \"insert it into the digital tuner and select Scan Again.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"insert it into the digital tuner and select scan again.\"), \"Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel","select Add DTV Channel.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel","$39","\"Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?\")"],"description_v3":[{"type":"text","value":"\"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear.\"), \"Select Your Connection}Select your connection from the list. The connection must have a saved user name and password"},{"type":"linebreak"},{"type":"text","value":"and be available to all users.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your connection}select your connection from the list. the connection must have a saved user name and password"},{"type":"linebreak"},{"type":"text","value":"and be available to all users.\"), \"Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed"},{"type":"linebreak"},{"type":"text","value":"select Not Listed at the bottom of the list.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed"},{"type":"linebreak"},{"type":"text","value":"select not listed at the bottom of the list.\"), \"Select the appropriate display resolution from the list below. For best results"},{"type":"linebreak"},{"type":"text","value":"use the resolution recommended by the manufacturer in the display hardware documentation.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select the appropriate display resolution from the list below. for best results"},{"type":"linebreak"},{"type":"text","value":"use the resolution recommended by the manufacturer in the display hardware documentation.\"), \"insert it into the digital tuner and select Scan Again.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"insert it into the digital tuner and select scan again.\"), \"Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel"},{"type":"linebreak"},{"type":"text","value":"select Add DTV Channel.\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel"},{"type":"linebreak"},{"type":"text","value":"$3a"},{"type":"linebreak"},{"type":"text","value":"\"Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?\" (Source: 00000000-00002956.00000001.68750.03450000.00000002.mdmp, 00000000-00002956.00000002.70669.03450000.00000002.mdmp, 00000000-00002956.00000003.78288.03450000.00000002.mdmp, Indicator: \"delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?\")"}],"origin":"File/Memory","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an executable section named \".text\"\n \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an executable section named \".itext\"","description_v2":["\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an executable section named \".text\"","\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an executable section named \".itext\""],"description_v3":[{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an executable section named \".text\""},{"type":"linebreak"},{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an executable section named \".itext\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".data\"\n \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".bss\"\n \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".idata\"\n \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".didata\"\n \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".tls\"","description_v2":["\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".data\"","\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".bss\"","\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".idata\"","\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".didata\"","\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".tls\""],"description_v3":[{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".bss\""},{"type":"linebreak"},{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".idata\""},{"type":"linebreak"},{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".didata\""},{"type":"linebreak"},{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has an writable section named \".tls\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,add\tesp, -0x10,push\tebx,mov\teax, 0x8d5ee4,call\t0x411420,mov\tebx, dword ptr [0x8f2bb0],push\t0,push\t0x8e5ed4,call\t0x4167e8,test\teax, eax,ja\t0x8e5ecc,mov\teax, dword ptr [ebx],call\t0x607e70,mov\teax, dword ptr [ebx],mov\tbyte ptr [eax + 0x6f], 0,mov\teax, dword ptr [ebx],xor\tedx, edx,call\t0x609be4,mov\teax, dword ptr [ebx],mov\tedx, 0x8e5ef8,call\t0x6078a4,mov\tecx, dword ptr [0x8f2820],mov\teax, dword ptr [ebx],mov\tedx, dword ptr [0x8d3dd0],call\t0x607e88,mov\tecx, dword ptr [0x8f2660],mov\teax, dword ptr [ebx],\"","description_v2":["\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,add\tesp, -0x10,push\tebx,mov\teax, 0x8d5ee4,call\t0x411420,mov\tebx, dword ptr [0x8f2bb0],push\t0,push\t0x8e5ed4,call\t0x4167e8,test\teax, eax,ja\t0x8e5ecc,mov\teax, dword ptr [ebx],call\t0x607e70,mov\teax, dword ptr [ebx],mov\tbyte ptr [eax + 0x6f], 0,mov\teax, dword ptr [ebx],xor\tedx, edx,call\t0x609be4,mov\teax, dword ptr [ebx],mov\tedx, 0x8e5ef8,call\t0x6078a4,mov\tecx, dword ptr [0x8f2820],mov\teax, dword ptr [ebx],mov\tedx, dword ptr [0x8d3dd0],call\t0x607e88,mov\tecx, dword ptr [0x8f2660],mov\teax, dword ptr [ebx],\""],"description_v3":[{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,add\tesp, -0x10,push\tebx,mov\teax, 0x8d5ee4,call\t0x411420,mov\tebx, dword ptr [0x8f2bb0],push\t0,push\t0x8e5ed4,call\t0x4167e8,test\teax, eax,ja\t0x8e5ecc,mov\teax, dword ptr [ebx],call\t0x607e70,mov\teax, dword ptr [ebx],mov\tbyte ptr [eax + 0x6f], 0,mov\teax, dword ptr [ebx],xor\tedx, edx,call\t0x609be4,mov\teax, dword ptr [ebx],mov\tedx, 0x8e5ef8,call\t0x6078a4,mov\tecx, dword ptr [0x8f2820],mov\teax, dword ptr [ebx],mov\tedx, dword ptr [0x8d3dd0],call\t0x607e88,mov\tecx, dword ptr [0x8f2660],mov\teax, dword ptr [ebx],\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-125","type":0,"relevance":3,"name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x4e1600\" greater than 0x100000","description_v2":["Raw size of \".text\" is \"0x4e1600\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Raw size of \".text\" is \"0x4e1600\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-124","type":0,"relevance":3,"name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4e1514\" greater than 0x100000","description_v2":["Virtual size of \".text\" is \"0x4e1514\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Virtual size of \".text\" is \"0x4e1514\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","description_v2":["\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-626","type":2,"relevance":1,"name":"References JavaScript(s)","description":"Found string \".js=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")\n Found string \".ls=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")\n Found string \".mocha=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found string \".js=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found string \".ls=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found string \".mocha=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found string \".js=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found string \".ls=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found string \".mocha=text/javascript\" (Indicator: \"text/javascript\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1059.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows filepaths for DLLs (possible dropped files)","description":"$3b","description_v2":["Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00002956-00000C24-19003068]","Observed system executable string:\"%WINDIR%\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll\" [Source: 00000000-00002956-00000C24-20252826]","Observed system executable string:\"%WINDIR%\\system32\\DUser.dll\" [Source: 00000000-00002956-00000C24-21045603]","Observed system executable string:\"%WINDIR%\\system32\\xmllite.dll\" [Source: 00000000-00002956-00000C24-21686723]","Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00002956-00000C24-22222725]","Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00002956-00000C24-22382854]","Observed system executable string:\"C:\\Windows\\Temp\\VxOle32.dll\" [Source: 00000000-00002956.00000000.66828.00010000.00000040.mdmp","00000000-00002956.00000000.66828.003C0000.00000002.mdmp","00000000-00002956.00000001.68750.00010000.00000040.mdmp","00000000-00002956.00000001.68750.003C0000.00000002.mdmp","00000000-00002956.00000002.70669.00010000.00000040.mdmp","00000000-00002956.00000002.70669.003C0000.00000002.mdmp","00000000-00002956.00000003.78288.00010000.00000040.mdmp","00000000-00002956.00000003.78288.003C0000.00000002.mdmp]","Observed system executable string:\"C:\\Windows\\Temp\\VxSSL32.dll\" [Source: 00000000-00002956.00000000.66828.00020000.00000040.mdmp","00000000-00002956.00000000.66828.00190000.00000002.mdmp","00000000-00002956.00000001.68750.00020000.00000040.mdmp","00000000-00002956.00000001.68750.00190000.00000002.mdmp","00000000-00002956.00000002.70669.00020000.00000040.mdmp","00000000-00002956.00000002.70669.00190000.00000002.mdmp","00000000-00002956.00000003.78288.00020000.00000040.mdmp","00000000-00002956.00000003.78288.00190000.00000002.mdmp]","Observed system executable string:\"C:\\Windows\\system32\\sxsoa.dll\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp","00000000-00002956.00000001.68750.00130000.00000002.mdmp","00000000-00002956.00000002.70669.00130000.00000002.mdmp","00000000-00002956.00000003.78288.00130000.00000002.mdmp]","Observed system executable string:\"C:\\Windows\\system32\\GdiPlus.dll\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp","00000000-00002956.00000001.68750.00130000.00000002.mdmp","00000000-00002956.00000002.70669.00130000.00000002.mdmp","00000000-00002956.00000003.78288.00130000.00000002.mdmp]","Observed system executable string:\"C:\\Windows\\system32\\comctl32.dll\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp","00000000-00002956.00000001.68750.00130000.00000002.mdmp","00000000-00002956.00000002.70669.00130000.00000002.mdmp","00000000-00002956.00000003.78288.00130000.00000002.mdmp]","Observed system executable string:\"C:\\Windows\\system32\\sxsoaps.dll\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp","00000000-00002956.00000001.68750.00130000.00000002.mdmp","00000000-00002956.00000002.70669.00130000.00000002.mdmp","00000000-00002956.00000003.78288.00130000.00000002.mdmp]","Observed system executable string:\"C:\\Windows\\system32\\comctl32.dll.mui\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp","00000000-00002956.00000001.68750.00130000.00000002.mdmp","00000000-00002956.00000002.70669.00130000.00000002.mdmp","00000000-00002956.00000003.78288.00130000.00000002.mdmp]","Observed system executable string:\"C:\\Windows\\system32\\uxtheme.dll\" [Source: 00000000-00002956.00000000.66828.00160000.00000004.mdmp","00000000-00002956.00000001.68750.00160000.00000004.mdmp","00000000-00002956.00000002.70669.00160000.00000004.mdmp","00000000-00002956.00000003.78288.00160000.00000004.mdmp]","Observed system executable string:\":\\Windows\\SYSTEM32\\ntdll.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\kernel32.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\KERNELBASE.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\msvcrt.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\GDI32.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\USER32.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\LPK.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\USP10.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\SHLWAPI.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\shell32.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]","Observed system executable string:\":\\Windows\\system32\\version.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp","00000000-00002956.00000001.68750.001C0000.00000004.mdmp","00000000-00002956.00000002.70669.001C0000.00000004.mdmp","00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00002956-00000C24-19003068]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll\" [Source: 00000000-00002956-00000C24-20252826]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\DUser.dll\" [Source: 00000000-00002956-00000C24-21045603]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\xmllite.dll\" [Source: 00000000-00002956-00000C24-21686723]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00002956-00000C24-22222725]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00002956-00000C24-22382854]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Temp\\VxOle32.dll\" [Source: 00000000-00002956.00000000.66828.00010000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000000.66828.003C0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00010000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.003C0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00010000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.003C0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00010000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.003C0000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"C:\\Windows\\Temp\\VxSSL32.dll\" [Source: 00000000-00002956.00000000.66828.00020000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000000.66828.00190000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00020000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00190000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00020000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00190000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00020000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00190000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"C:\\Windows\\system32\\sxsoa.dll\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00130000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"C:\\Windows\\system32\\GdiPlus.dll\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00130000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"C:\\Windows\\system32\\comctl32.dll\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00130000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"C:\\Windows\\system32\\sxsoaps.dll\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00130000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"C:\\Windows\\system32\\comctl32.dll.mui\" [Source: 00000000-00002956.00000000.66828.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00130000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00130000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"C:\\Windows\\system32\\uxtheme.dll\" [Source: 00000000-00002956.00000000.66828.00160000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.00160000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.00160000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.00160000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\SYSTEM32\\ntdll.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\kernel32.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\KERNELBASE.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\msvcrt.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\GDI32.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\USER32.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\LPK.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\USP10.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\SHLWAPI.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\shell32.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\":\\Windows\\system32\\version.dll\" [Source: 00000000-00002956.00000000.66828.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000001.68750.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000002.70669.001C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002956.00000003.78288.001C0000.00000004.mdmp]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-70","type":6,"relevance":10,"name":"Scanning for window names","description":"\"WinXCorners.exe\" searching for class \"WinXCorners\"","description_v2":["\"WinXCorners.exe\" searching for class \"WinXCorners\""],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" searching for class \"WinXCorners\""}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-262","type":6,"relevance":1,"name":"Allocates virtual memory in a self process","description":"\"WinXCorners.exe\" allocated memory in \"C:\\WinXCorners.exe\" with (Protection: \"read/write\")","description_v2":["\"WinXCorners.exe\" allocated memory in \"C:\\WinXCorners.exe\" with (Protection: \"read/write\")"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" allocated memory in \"C:\\WinXCorners.exe\" with (Protection: \"read/write\")"}],"origin":"API Call","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-16","type":6,"relevance":1,"name":"Connects to LPC ports","description":"\"WinXCorners.exe\" connecting to \"\\ThemeApiPort\"","description_v2":["\"WinXCorners.exe\" connecting to \"\\ThemeApiPort\""],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" connecting to \"\\ThemeApiPort\""}],"origin":"API Call","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"WinXCorners.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","description_v2":["\"WinXCorners.exe\" creates a thread in process \"-1\" (Handle: 4294967295)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" creates a thread in process \"-1\" (Handle: 4294967295)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$3c","description_v2":["\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\\ASSEMBLYSTORAGEROOTS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\ERROR MESSAGE INSTRUMENT\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IME COMPATIBILITY\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\\MACHINELANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MUI\\SETTINGS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\CONTROL PANEL\\DESKTOP\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\LANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\\TRACING\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLEAUT\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\DIAGNOSTICS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\EMBARCADERO\\LOCALES\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\EMBARCADERO\\LOCALES\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\CODEGEAR\\LOCALES\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CODEGEAR\\LOCALES\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\LOCALES\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\WINDOWS ERROR REPORTING\\WMR\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\\ALTERNATE SORTS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\FONTSUBSTITUTES\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS NT\\RPC\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SQMCLIENT\\WINDOWS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\FONTLINK\\SYSTEMLINK\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\DATASTORE_V1.0\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\\SEGOE UI\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\VIDEO\\{8FE042CE-FE53-4517-9B5E-ADE4C2FC3C64}\\0000\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_80EE&DEV_BEEF&SUBSYS_040515AD&REV_00\\3&267A616A&0&10\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\DIRECTUI\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\COMPATIBILITY\\WINXCORNERS.EXE\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\\LANGUAGEPROFILE\\0X00000000\\{0001BEA3-ED56-483D-A2E2-AEAE25577436}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{FA445657-9379-11D6-B41A-00065B83EE53}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\KEYBOARD LAYOUT\\TOGGLE\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\APP MANAGEMENT\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\APP MANAGEMENT\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\CTF\\DIRECTSWITCHHOTKEYS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\KNOWNCLASSES\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\\ASSEMBLYSTORAGEROOTS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\ERROR MESSAGE INSTRUMENT\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IME COMPATIBILITY\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\\MACHINELANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MUI\\SETTINGS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\CONTROL PANEL\\DESKTOP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\LANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\\TRACING\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLEAUT\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\DIAGNOSTICS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\EMBARCADERO\\LOCALES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\EMBARCADERO\\LOCALES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\CODEGEAR\\LOCALES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CODEGEAR\\LOCALES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\LOCALES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\WINDOWS ERROR REPORTING\\WMR\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\\ALTERNATE SORTS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\FONTSUBSTITUTES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS NT\\RPC\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SQMCLIENT\\WINDOWS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\FONTLINK\\SYSTEMLINK\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\DATASTORE_V1.0\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\\SEGOE UI\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\VIDEO\\{8FE042CE-FE53-4517-9B5E-ADE4C2FC3C64}\\0000\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_80EE&DEV_BEEF&SUBSYS_040515AD&REV_00\\3&267A616A&0&10\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\DIRECTUI\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\COMPATIBILITY\\WINXCORNERS.EXE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\\LANGUAGEPROFILE\\0X00000000\\{0001BEA3-ED56-483D-A2E2-AEAE25577436}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{FA445657-9379-11D6-B41A-00065B83EE53}\\CATEGORY\\CATEGORY\\{534C48C1-0607-4098-A521-4FC899C73E90}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\KEYBOARD LAYOUT\\TOGGLE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\APP MANAGEMENT\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\APP MANAGEMENT\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\CTF\\DIRECTSWITCHHOTKEYS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\KNOWNCLASSES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$3d","description_v2":["\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"CWDILLEGALINDLLSEARCH\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"COMPATDLL\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"00060101.00060101\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"WINXCORNERS\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\"; Key: \"LOADAPPINIT_DLLS\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\"; Key: \"PREFEREXTERNALMANIFEST\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\WINDOWS ERROR REPORTING\\WMR\"; Key: \"DISABLE\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\FONTSUBSTITUTES\"; Key: \"MS SHELL DLG 2\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"MAXRPCSIZE\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"OOBEINPROGRESS\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"SYSTEMSETUPINPROGRESS\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SQMCLIENT\\WINDOWS\"; Key: \"CEIPENABLE\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\DATASTORE_V1.0\"; Key: \"DISABLE\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\DATASTORE_V1.0\"; Key: \"DATAFILEPATH\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE1\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE2\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE3\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE4\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE5\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE6\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE7\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE8\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE9\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE10\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE11\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE12\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE13\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE14\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE15\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE16\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"MAXOBJECTNUMBER\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"\\DEVICE\\VIDEO3\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\VIDEO\\{8FE042CE-FE53-4517-9B5E-ADE4C2FC3C64}\\0000\"; Key: \"PRUNINGMODE\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_80EE&DEV_BEEF&SUBSYS_040515AD&REV_00\\3&267A616A&0&10\"; Key: \"HARDWAREID\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"CURRENTVERSION\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\\LANGUAGEPROFILE\\0X00000000\\{0001BEA3-ED56-483D-A2E2-AEAE25577436}\"; Key: \"ENABLE\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\KEYBOARD LAYOUT\\TOGGLE\"; Key: \"LANGUAGE HOTKEY\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\KEYBOARD LAYOUT\\TOGGLE\"; Key: \"HOTKEY\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\KEYBOARD LAYOUT\\TOGGLE\"; Key: \"LAYOUT HOTKEY\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"COM+ENABLED\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"MAXSXSHASHCOUNT\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\"; Key: \"ENABLEANCHORCONTEXT\"; Value: \"\")","\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\"; Key: \"TURNOFFSPIANIMATIONS\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"CWDILLEGALINDLLSEARCH\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"COMPATDLL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"00060101.00060101\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"WINXCORNERS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\"; Key: \"LOADAPPINIT_DLLS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\"; Key: \"PREFEREXTERNALMANIFEST\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\WINDOWS ERROR REPORTING\\WMR\"; Key: \"DISABLE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\FONTSUBSTITUTES\"; Key: \"MS SHELL DLG 2\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"MAXRPCSIZE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"OOBEINPROGRESS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"SYSTEMSETUPINPROGRESS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SQMCLIENT\\WINDOWS\"; Key: \"CEIPENABLE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\DATASTORE_V1.0\"; Key: \"DISABLE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\DATASTORE_V1.0\"; Key: \"DATAFILEPATH\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE1\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE2\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE3\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE4\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE5\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE6\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE7\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE8\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE9\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE10\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE11\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE12\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE13\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE14\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE15\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\LANGUAGEPACK\\SURROGATEFALLBACK\"; Key: \"PLANE16\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"MAXOBJECTNUMBER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"\\DEVICE\\VIDEO3\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\VIDEO\\{8FE042CE-FE53-4517-9B5E-ADE4C2FC3C64}\\0000\"; Key: \"PRUNINGMODE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_80EE&DEV_BEEF&SUBSYS_040515AD&REV_00\\3&267A616A&0&10\"; Key: \"HARDWAREID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"CURRENTVERSION\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{0000897B-83DF-4B96-BE07-0FB58B01C4A4}\\LANGUAGEPROFILE\\0X00000000\\{0001BEA3-ED56-483D-A2E2-AEAE25577436}\"; Key: \"ENABLE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\KEYBOARD LAYOUT\\TOGGLE\"; Key: \"LANGUAGE HOTKEY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\KEYBOARD LAYOUT\\TOGGLE\"; Key: \"HOTKEY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\KEYBOARD LAYOUT\\TOGGLE\"; Key: \"LAYOUT HOTKEY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"COM+ENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"MAXSXSHASHCOUNT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CTF\"; Key: \"ENABLEANCHORCONTEXT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\"; Key: \"TURNOFFSPIANIMATIONS\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"WinXCorners.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","description_v2":["\"WinXCorners.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\""],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" reads file \"%WINDIR%\\fonts\\staticcache.dat\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to evade analysis by sleeping many times","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Contains ability to detect sandbox (imports API)"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to evade analysis by sleeping many times"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to detect sandbox (imports API)"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"$3e","description_v2":["\"WinXCorners.exe\" trying to touch file \"C:\\winspool.drv\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\winspool.drv\"","\"WinXCorners.exe\" trying to touch file \"C:\\WinXCorners.exe.Local\\\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\version.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\version.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\SYSTEM32\\sechost.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\netapi32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\netapi32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\netutils.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\netutils.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\srvcli.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\srvcli.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\wkscli.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\wkscli.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\winhttp.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\winhttp.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\IMM32.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\FLTLIB.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\FLTLIB.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\api-ms-win-core-synch-l1-2-0.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\uxtheme.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\rpcss.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\CRYPTBASE.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\CRYPTBASE.dll\"","\"WinXCorners.exe\" trying to touch file \"\\Device\\KsecDD\"","\"WinXCorners.exe\" trying to touch file \"C:\\wtsapi32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\wtsapi32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\WINSTA.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\WINSTA.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\security.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\security.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\SECUR32.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\SECUR32.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\SSPICLI.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\SSPICLI.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\"","\"WinXCorners.exe\" trying to touch file \"C:\\DUser.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\DUser.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\xmllite.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\imageres.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\imageres.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\webio.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\webio.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\Temp\\VxOle32.dll\"","\"WinXCorners.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\tzres.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\WINSPOOL.DRV\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\winspool.drv\"","\"WinXCorners.exe\" trying to touch file \"C:\\WINXCORNERS.EXE.LOCAL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\VERSION.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\NETAPI32.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\netapi32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\NETUTILS.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\netutils.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\SRVCLI.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\srvcli.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\WKSCLI.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\wkscli.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\WINHTTP.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\winhttp.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\webio.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\dwmapi.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\dwmapi.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\SAMCLI.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\samcli.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\tzres.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\uxtheme.dll.Config\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\uxtheme.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\rpcss.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\CRYPTBASE.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\dwmapi.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\WTSAPI32.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\wtsapi32.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\WINSTA.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\winsta.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\Fonts\\StaticCache.dat\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\user32.dll.mui\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\GdiPlus.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"WinXCorners.exe\" trying to touch file \"C:\\SECURITY.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\security.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\"","\"WinXCorners.exe\" trying to touch file \"C:\\DUSER.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\duser.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\xmllite.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\IMAGERES.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\imageres.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\msctf.dll.mui\"","\"WinXCorners.exe\" trying to touch file \"C:\\WEBIO.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\cryptbase.dll\"","\"WinXCorners.exe\" trying to touch file \"C:\\DWMAPI.DLL\"","\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\UXTHEME.DLL.CONFIG\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\winspool.drv\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\version.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\sechost.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\netapi32.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\netutils.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\srvcli.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\wkscli.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\winhttp.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\webio.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\imm32.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\WindowsShell.Manifest\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\Temp\\VxSSL32.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\fltLib.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\api-ms-win-core-synch-l1-2-0.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\samcli.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\tzres.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\rpcss.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\wtsapi32.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\winsta.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\Fonts\\StaticCache.dat\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\GdiPlus.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\security.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\secur32.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\sspicli.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\duser.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\xmllite.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\Temp\\VxOle32.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\cryptbase.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\dwmapi.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\UXTHEME.DLL.CONFIG\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\uxtheme.dll\"","\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\imageres.dll\""],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\winspool.drv\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\system32\\winspool.drv\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WinXCorners.exe.Local\\\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\version.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\version.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\SYSTEM32\\sechost.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\netapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\netapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\netutils.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\netutils.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\srvcli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\srvcli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\wkscli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\wkscli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\winhttp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\winhttp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\IMM32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\api-ms-win-core-synch-l1-2-0.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\uxtheme.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\rpcss.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\CRYPTBASE.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\CRYPTBASE.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\wtsapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\wtsapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WINSTA.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\WINSTA.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\security.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\security.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\SECUR32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\SECUR32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\SSPICLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\SSPICLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\DUser.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\DUser.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\xmllite.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\imageres.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\imageres.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\webio.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\webio.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\Temp\\VxOle32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\tzres.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WINSPOOL.DRV\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\winspool.drv\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WINXCORNERS.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\VERSION.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\NETAPI32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\netapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\NETUTILS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\netutils.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\SRVCLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\srvcli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WKSCLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\wkscli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WINHTTP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\winhttp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\webio.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\dwmapi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\dwmapi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\SAMCLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\samcli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\tzres.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\system32\\uxtheme.dll.Config\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\uxtheme.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\rpcss.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\CRYPTBASE.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\dwmapi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WTSAPI32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\wtsapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WINSTA.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\winsta.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\Fonts\\StaticCache.dat\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\user32.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\GdiPlus.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\SECURITY.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\security.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\DUSER.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\duser.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\xmllite.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\IMAGERES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\imageres.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\msctf.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\WEBIO.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\cryptbase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\DWMAPI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"C:\\Windows\\System32\\UXTHEME.DLL.CONFIG\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\winspool.drv\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\version.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\sechost.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\netapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\netutils.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\srvcli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\wkscli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\winhttp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\webio.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\imm32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\WindowsShell.Manifest\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\Temp\\VxSSL32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\fltLib.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\api-ms-win-core-synch-l1-2-0.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\samcli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\tzres.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\rpcss.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\wtsapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\winsta.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\Fonts\\StaticCache.dat\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\GdiPlus.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\security.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\secur32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\sspicli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\duser.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\xmllite.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\Temp\\VxOle32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\cryptbase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\dwmapi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\UXTHEME.DLL.CONFIG\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\uxtheme.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to touch file \"%WINDIR%\\System32\\imageres.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$3f","description_v2":["\"WinXCorners.exe\" trying to access non-existent file \"C:\\version.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\netapi32.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\netutils.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\srvcli.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\wkscli.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\winhttp.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\wtsapi32.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINSTA.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\security.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\SECUR32.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\SSPICLI.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\DUser.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\imageres.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\webio.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\VERSION.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\NETAPI32.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\NETUTILS.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\SRVCLI.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WKSCLI.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINHTTP.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\dwmapi.dll\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\SAMCLI.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WTSAPI32.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINSTA.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\SECURITY.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\DUSER.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\IMAGERES.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WEBIO.DLL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\DWMAPI.DLL\""],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\version.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\netapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\netutils.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\srvcli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\wkscli.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\winhttp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"%WINDIR%\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\wtsapi32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINSTA.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\security.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\SECUR32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\SSPICLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\DUser.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\imageres.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\webio.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\VERSION.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\NETAPI32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\NETUTILS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\SRVCLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WKSCLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINHTTP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\dwmapi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\SAMCLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WTSAPI32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINSTA.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\SECURITY.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\DUSER.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\IMAGERES.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WEBIO.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\DWMAPI.DLL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\winspool.drv\"\n \"WinXCorners.exe\" trying to access non-existent file \"C:\\WinXCorners.exe.Local\\\"\n \"WinXCorners.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\"\n \"WinXCorners.exe\" trying to access non-existent file \"C:\\WINXCORNERS.EXE.LOCAL\"\n \"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\system32\\uxtheme.dll.Config\"\n \"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\System32\\UXTHEME.DLL.CONFIG\"","description_v2":["\"WinXCorners.exe\" trying to access non-existent file \"C:\\winspool.drv\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WinXCorners.exe.Local\\\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINXCORNERS.EXE.LOCAL\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\system32\\uxtheme.dll.Config\"","\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\System32\\UXTHEME.DLL.CONFIG\""],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\winspool.drv\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WinXCorners.exe.Local\\\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\WINXCORNERS.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"%WINDIR%\\system32\\uxtheme.dll.Config\""},{"type":"linebreak"},{"type":"text","value":"\"WinXCorners.exe\" trying to access non-existent file \"C:\\Windows\\System32\\UXTHEME.DLL.CONFIG\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"api-218","type":6,"relevance":3,"name":"Calls an API typically used to create string binding handle (RPC)","description":"\"WinXCorners.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00002956)","description_v2":["\"WinXCorners.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00002956)"],"description_v3":[{"type":"text","value":"\"WinXCorners.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00002956)"}],"origin":"API Call","attck_id":"T1021","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1021","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-228","type":2,"relevance":1,"name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$40","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecvMsg\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvMsg\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"$41","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSARecvMsg\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvMsg\" (Indicator: \"WSARecv\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-419","type":2,"relevance":1,"name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-190","type":2,"relevance":3,"name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","description_v2":["Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")","Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002956.00000000.66828.008F9000.00000004.mdmp, 00000000-00002956.00000001.68750.008F9000.00000004.mdmp, 00000000-00002956.00000002.70669.008F9000.00000004.mdmp, 00000000-00002956.00000003.78288.008F9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1135","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1135","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-511","type":2,"relevance":1,"name":"Contains ability to upload file/data","description":"Found string \"%sContent-Disposition: form-data; name=\"%s\"\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")\n Found string \"Content-Disposition: form-data; name=\"\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","description_v2":["Found string \"%sContent-Disposition: form-data; name=\"%s\"\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")","Found string \"Content-Disposition: form-data; name=\"\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"],"description_v3":[{"type":"text","value":"Found string \"%sContent-Disposition: form-data; name=\"%s\"\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Content-Disposition: form-data; name=\"\"; File: \"675ab42b6986cc831886d7c04cb07f2826183af1a6bd698d47f1308931acd4f2.bin\")"}],"origin":"File/Memory","attck_id":"T1041","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1041","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-3","type":20,"relevance":1,"name":"Found potential IP urls in memory dumps","description":"Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")\n Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000002.70669.03450000.00000002.mdmp\")\n Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000003.78288.03450000.00000002.mdmp\")","description_v2":["Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000002.70669.03450000.00000002.mdmp\")","Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000003.78288.03450000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000002.70669.03450000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found IP URL \"ftp://157.54.23.41/\" - Source: \"00000000-00002956.00000003.78288.03450000.00000002.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$42","description_v2":["Heuristic match: \"video/vnd.dece.sd\"","Pattern match: \"http://direct:80\"","Pattern match: \"http://apps.codigobit.info/p/support.html\"","Pattern match: \"http://www.indyproject.org/Original\"","Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","Heuristic match: \"Font.Name\"","Heuristic match: \"C+\t.Dz\"","Pattern match: \"http://schemas.microsoft.com/SMI/2016/WindowsSettings\"","Heuristic match: \"PATHEXT=.COM;.EXE;.BAT;.CM\"","Pattern match: \"http://www.indyproject.org/\"","Pattern match: \"http://www.windows.com/pctv\"","Pattern match: \"http://go.microsoft.com/fwlink/?linkid=53081\"","Pattern match: \"www.microsoft.com/extender/help\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwl\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=70599\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=145837\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkID=57190\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=145765\"","Heuristic match: \"Example: computer.fabrikam.com\"","Pattern match: \"vista.gallery.microsoft.com/vista/SideShow.aspx\"","Pattern match: \"http://www.icra.org/vocabulary/\"","Pattern match: \"wmploc.dll/Offline_Buy.htm'res://wmploc.dll/Offline_MediaGuide.htm*res://wmploc.dll/Offline_Subscriptions.htm\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=32146res://wmploc.dll/ICW_ErrorPage.htm\"","Pattern match: \"wmploc.dll/Service_Initial.htm\"","Pattern match: \"wmploc.dll/Error_ServiceInfo.htm'res://wmploc.dll/Offline_InfoCenter.htm&res://wmploc.dll/Offline_AlbumInfo.htm\"","Pattern match: \"wmploc.dll/Service_NoFunc.htm%res://wmploc.dll/Service_No_Local.htm\"","Pattern match: \"wmploc.dll/RT_IMAGE/ServiceLarge.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png\"","Pattern match: \"wmploc.dll/Blocked_AlbumInfo.htm&res://wmploc.dll/Blocked_AlbumInfo.htm,http://go.microsoft.com/fwlink/?LinkId=70183'res://wmploc.dll/offline_radioguide.htm\"","Pattern match: \"http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/\"","Pattern match: \"redir.metaservices.microsoft.com/dvdcover/P\"","Pattern match: \"http://redir.metaservices.microsoft.com/redir/buynow/\"","Pattern match: \"http://windowsmedia.com/redir/findmedia.asp\"","Pattern match: \"redir.metaservices.microsoft.com/redir/getmdrdvd/\"","Pattern match: \"redir.metaservices.microsoft.com/redir/getmdrcd/?Bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?Ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=h\"","Pattern match: \"redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/QueryTOCExt.asp1res://wmploc.dll/Offline_MediaInfo_NowPlaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=321507Optimized\"","Pattern match: \"http://go.microsoft.com/fwlink/?linkid=8792\"","Pattern match: \"http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/QueryTOCNP.asp#Show\"","Pattern match: \"http://windowsmedia.com/redir/services.asp?WMPFriendly=true\"","Pattern match: \"http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5\"","Pattern match: \"http://www.w3.org/1999/XSL/Transform\"","Pattern match: \"http://*.microsoft.co.jp\"","Pattern match: \"http://microsoft.*.com\"","Pattern match: \"www.treyresearch.net\"","Pattern match: \"http://treyresearch.net\"","Heuristic match: \"- fineartschool.net\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=226247\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=233329\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=228745\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=787651\"","Heuristic match: \"GridParent.Height = Grid.Height + Grid.Top\"","Pattern match: \"http://www.w3.org/2001/XMLSchema\"","Pattern match: \"http://www.iec.ch\"","Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=121315\"","Pattern match: \"http://go.microsoft.com/fwlink/p/?LinkId=255142\""],"description_v3":[{"type":"text","value":"Heuristic match: \"video/vnd.dece.sd\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://direct:80\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://apps.codigobit.info/p/support.html\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.indyproject.org/Original\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"Font.Name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"C+\t.Dz\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/SMI/2016/WindowsSettings\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"PATHEXT=.COM;.EXE;.BAT;.CM\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.indyproject.org/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.windows.com/pctv\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?linkid=53081\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/extender/help\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwl\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=70599\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=145837\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkID=57190\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=145765\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"Example: computer.fabrikam.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"vista.gallery.microsoft.com/vista/SideShow.aspx\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.icra.org/vocabulary/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"wmploc.dll/Offline_Buy.htm'res://wmploc.dll/Offline_MediaGuide.htm*res://wmploc.dll/Offline_Subscriptions.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=32146res://wmploc.dll/ICW_ErrorPage.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"wmploc.dll/Service_Initial.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"wmploc.dll/Error_ServiceInfo.htm'res://wmploc.dll/Offline_InfoCenter.htm&res://wmploc.dll/Offline_AlbumInfo.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"wmploc.dll/Service_NoFunc.htm%res://wmploc.dll/Service_No_Local.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"wmploc.dll/RT_IMAGE/ServiceLarge.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"wmploc.dll/Blocked_AlbumInfo.htm&res://wmploc.dll/Blocked_AlbumInfo.htm,http://go.microsoft.com/fwlink/?LinkId=70183'res://wmploc.dll/offline_radioguide.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"redir.metaservices.microsoft.com/dvdcover/P\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://redir.metaservices.microsoft.com/redir/buynow/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://windowsmedia.com/redir/findmedia.asp\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"redir.metaservices.microsoft.com/redir/getmdrdvd/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"redir.metaservices.microsoft.com/redir/getmdrcd/?Bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?Ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=h\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/QueryTOCExt.asp1res://wmploc.dll/Offline_MediaInfo_NowPlaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=321507Optimized\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?linkid=8792\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/QueryTOCNP.asp#Show\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://windowsmedia.com/redir/services.asp?WMPFriendly=true\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/1999/XSL/Transform\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://*.microsoft.co.jp\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://microsoft.*.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.treyresearch.net\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://treyresearch.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- fineartschool.net\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=226247\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=233329\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=228745\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=787651\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"GridParent.Height = Grid.Height + Grid.Top\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/XMLSchema\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.iec.ch\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=121315\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/p/?LinkId=255142\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-2","type":20,"relevance":1,"name":"Found potential URLs in memory dumps","description":"$43","description_v2":["Found URL \"http://www.indyproject.org/original\" - Source: \"00000000-00002956.00000000.66828.01AE0000.00000004.mdmp\")","Found URL \"http://www.indyproject.org/original\" - Source: \"00000000-00002956.00000001.68750.01AE0000.00000004.mdmp\")","Found URL \"http://www.windows.com/pctv.update\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://www.windows.com/pctv.select\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=53081\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=70599help\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=57190microsoft\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=32146\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=321507optimized\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=8792hdcd\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter\" - Source: \"00000000-00002956.00000001.68750.03450000.00000002.mdmp\")","Found URL \"http://timevalue