24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T462,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 6b96f6652af9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6b96f6652af9…. Malware family: Malware. Threat score 100/100. 5/28 AV engines flagged this file. 6 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6b96f6652af99c513bbe89a4c5e61e2729aa1f67ce0c0c3d0ca28d2959dcd82c","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","6b96f6652af99c513bbe89a4c5e61e2729aa1f67ce0c0c3d0ca28d2959dcd82c"],"about":{"@type":"SoftwareApplication","name":"fra.exe","applicationCategory":["peexe","executable"],"identifier":"6b96f6652af99c513bbe89a4c5e61e2729aa1f67ce0c0c3d0ca28d2959dcd82c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T53c,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to "CspParameters" (Indicator: "CspParameters"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp")26:T62a,Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-915-0040D452 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-915-0040D452 Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-116-00411EF9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-116-00411EF9 Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-298-00414077 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-298-00414077 Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-921-00418729 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-921-00418729 Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-977-00414A77 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-977-00414A77 Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-916-004152A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-916-004152A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-976-00414A03 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-976-00414A03 Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-981-00414C49 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-981-00414C49 Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-834-0041281A Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-834-0041281A Assembly shows XOR instruction xor eax ebp in Stream UID: 29265-974-0041496B Assembly shows XOR instruction xor ecx ebp in Stream UID: 29265-974-0041496B27:Teb0,"fra.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002864) "fra.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002864) "fra.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96c40e5bf0166ffcc0499ffff04ccffff0430e5bf010000c96c0000000001000000 (UID: 00000000-00002864) "fra.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e8a1b0e8ee0ebbf012a9d3c7700000000248351770400000000000000000000005cfdbf0100000000e79c3c7702000780f4e5bf01000000001400000044e6bf01feffffffcce5bf01cf005b77d6005b77ec18d276140000000a00000044e6bf016f006e00a0e5bf016e00740008e6bf01 (UID: 00000000-00002864) "fra.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002864) "fra.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000074db9f01000000000600000000009169a0db9f0102000040a4dd9f01a4dd9f011a125c77000000008cdb9f0100000000d0b2180002035c770002000088015c7700000000e8dd9f01a4015c770000000000000000000000015500530045005200330032002e0064006c006c00000000000000000000005577000055770000000052dc9f01d000557774db9f0150dc9f019cdc9f0195e15677c8f53700fefffffff5f65a7716f85a77c81c160052dc9f0148dc9f0048dc9f0101000000acdc9f019ef85a77626f5a7764f85a778c21f276741291690cdd9f010000000000005577 (UID: 00000000-00002864)28:Tc5a,"fra.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\\mscoreeis.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002864) "fra.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00002864)29:T2f59,"fra.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00002864) "fra.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00002864)2a:Tbfa,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.")2b:T5366,Found reference to API (Indicator: "EncodePointer"; File: "fra.exe") Found reference to API (Indicator: "DecodePointer"; File: "fra.exe") Found reference to API (Indicator: "FlsFree"; File: "fra.exe") Found reference to API (Indicator: "FlsSetValue"; File: "fra.exe") Found reference to API (Indicator: "FlsGetValue"; File: "fra.exe") Found reference to API (Indicator: "FlsAlloc"; File: "fra.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "fra.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "fra.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "fra.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "fra.exe") Found reference to API (Indicator: "MessageBoxA"; File: "fra.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "fra.exe") Found reference to API (Indicator: "Sleep"; File: "fra.exe") Found reference to API (Indicator: "CreateThread"; File: "fra.exe") Found reference to API (Indicator: "lstrlenW"; File: "fra.exe") Found reference to API (Indicator: "VirtualProtect"; File: "fra.exe") Found reference to API (Indicator: "GetProcAddress"; File: "fra.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "fra.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "fra.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "fra.exe") Found reference to API (Indicator: "GlobalFindAtomA"; File: "fra.exe") Found reference to API (Indicator: "FreeConsole"; File: "fra.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "fra.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "fra.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "fra.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "fra.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "fra.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "fra.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "fra.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "fra.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "fra.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "fra.exe") Found reference to API (Indicator: "GetLastError"; File: "fra.exe") Found reference to API (Indicator: "HeapFree"; File: "fra.exe") Found reference to API (Indicator: "HeapAlloc"; File: "fra.exe") Found reference to API (Indicator: "RtlUnwind"; File: "fra.exe") Found reference to API (Indicator: "RaiseException"; File: "fra.exe") Found reference to API (Indicator: "TerminateProcess"; File: "fra.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "fra.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "fra.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "fra.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "fra.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "fra.exe") Found reference to API (Indicator: "GetCPInfo"; File: "fra.exe") Found reference to API (Indicator: "LCMapStringA"; File: "fra.exe") Found reference to API (Indicator: "LCMapStringW"; File: "fra.exe") Found reference to API (Indicator: "HeapCreate"; File: "fra.exe") Found reference to API (Indicator: "VirtualFree"; File: "fra.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "fra.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "fra.exe") Found reference to API (Indicator: "ExitProcess"; File: "fra.exe") Found reference to API (Indicator: "WriteFile"; File: "fra.exe") Found reference to API (Indicator: "GetStdHandle"; File: "fra.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "fra.exe") Found reference to API (Indicator: "TlsGetValue"; File: "fra.exe") Found reference to API (Indicator: "TlsAlloc"; File: "fra.exe") Found reference to API (Indicator: "TlsSetValue"; File: "fra.exe") Found reference to API (Indicator: "TlsFree"; File: "fra.exe") Found reference to API (Indicator: "SetLastError"; File: "fra.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "fra.exe") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "fra.exe") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "fra.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "fra.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "fra.exe") Found reference to API (Indicator: "SetHandleCount"; File: "fra.exe") Found reference to API (Indicator: "GetFileType"; File: "fra.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "fra.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "fra.exe") Found reference to API (Indicator: "GetTickCount"; File: "fra.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "fra.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "fra.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "fra.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "fra.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "fra.exe") Found reference to API (Indicator: "ReadFile"; File: "fra.exe") Found reference to API (Indicator: "SetFilePointer"; File: "fra.exe") Found reference to API (Indicator: "CloseHandle"; File: "fra.exe") Found reference to API (Indicator: "HeapSize"; File: "fra.exe") Found reference to API (Indicator: "GetACP"; File: "fra.exe") Found reference to API (Indicator: "GetOEMCP"; File: "fra.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "fra.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "fra.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "fra.exe") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "fra.exe") Found reference to API (Indicator: "IsValidLocale"; File: "fra.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "fra.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "fra.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "fra.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "fra.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "fra.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "fra.exe") Found reference to API (Indicator: "SetStdHandle"; File: "fra.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "fra.exe") Found reference to API (Indicator: "CreateFileA"; File: "fra.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "fra.exe") Found reference to API (Indicator: "CreateService"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "PathCombine"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "LoadCursor"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00002864.00000001.65554.00262000.00000020.mdmp, 00000000-00002864.00000001.65554.00425000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.031E0000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp, 00000000-00002864.00000001.65554.699E0000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002864.00000001.65554.0041F000.00000002.mdmp")2c:T4ce,"\Sessions\1\BaseNamedObjects\IsoScope_ed0_IESQMMUTEX_0_519" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_ed0_IESQMMUTEX_0_331" "IsoScope_ed0_IESQMMUTEX_0_519" "Local\VERMGMTBlockListFileMutex" "IsoScope_ed0_ConnHashTable<3792>_HashTable_Mutex" "Local\URLBLOCK_DOWNLOAD_MUTEX" "Local\!BrowserEmulation!SharedMemory!Mutex" "IsoScope_ed0_IE_EarlyTabStart_0xe80_Mutex" "Local\ZonesCacheCounterMutex" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3792" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "IsoScope_ed0_IESQMMUTEX_0_303" "UpdatingNewTabPageData" "Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3792" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_ed0_IE_EarlyTabStart_0xe80_Mutex"2d:T502,Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_fra.exe") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_fra.exe") Found string "" (Indicator: "github.com")2f:Tb22,"fra.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72ff0000 "fra.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "fra.exe" loaded module "KERNEL32" at base 75a60000 "fra.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "fra.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69870000 "fra.exe" loaded module "ADVAPI32.DLL" at base 76960000 "fra.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 69790000 "fra.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "fra.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "fra.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MUI\0409\\MSCOREEIS.DLL" at base 0 "fra.exe" loaded module "USER32.DLL" at base 76a10000 "fra.exe" loaded module "IMM32.DLL" at base 776b0000 "fra.exe" loaded module "COMCTL32.DLL" at base 69910000 "fra.exe" loaded module "USER32" at base 76a10000 "fra.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74040000 "fra.exe" loaded module "DWMAPI.DLL" at base 73c10000 "fra.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 771b0000 "fra.exe" loaded module "CRYPTBASE.DLL" at base 75350000 "fra.exe" loaded module "KERNEL32.DLL" at base 75a60000 "fra.exe" loaded module "CLBCATQ.DLL" at base 75790000 "fra.exe" loaded module "OLEAUT32.DLL" at base 76ae0000 "fra.exe" loaded module "SHELL32.DLL" at base 75b40000 "fra.exe" loaded module "OLE32.DLL" at base 771b0000 "fra.exe" loaded module "MSCOREE.DLL" at base 69820000 "fra.exe" loaded module "SHLWAPI.DLL" at base 75870000 "fra.exe" loaded module "COMCTL32.DLL" at base 742d0000 "fra.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEIS.DLL" at base 69780000 "fra.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 758f0000 "fra.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75a60000 "fra.exe" loaded module "SETUPAPI.DLL" at base 767c0000 "fra.exe" loaded module "PROPSYS.DLL" at base 740a0000 "fra.exe" loaded module "APPHELP.DLL" at base 75300000 "fra.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6cc90000 "fra.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75600000 "fra.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75610000 "fra.exe" loaded module "URLMON.DLL" at base 76c30000 "fra.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 69570000 "fra.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 740a0000 "fra.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 699a0000 "fra.exe" loaded module "IERTUTIL.DLL" at base 77310000 "fra.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75b40000 "fra.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7530000030:T64d,Found string "" (Indicator: "text/javascript"; File: "3N4TX92P.htm") Found string "" (Indicator: "text/javascript"; File: "3N4TX92P.htm") Found string "" (Indicator: "text/javascript"; File: "3N4TX92P.htm") Found string "" (Indicator: "text/javascript"; File: "3N4TX92P.htm") Found string "