24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious QD:Trojan.GenericQ Sample 809a49e7d55c… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample 809a49e7d55c…. Malware family: QD:Trojan.GenericQ. Threat score 86/100. 8/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e","keywords":["Malicious","QD:Trojan.GenericQ","malware analysis","sandbox report","threat intelligence","809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e"],"about":{"@type":"SoftwareApplication","name":"bounty-97160743081577335","applicationCategory":["peexe","64bits","executable"],"identifier":"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"QD:Trojan.GenericQ","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8dc,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceA" with parameter "13859100" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "14203564" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "19311172" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "20057872" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "20235872" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578777516656" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578839634432" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578777517184" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578838577680" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578838589632" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578838569856" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578838481168" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578852711216" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578852718128" - (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "FindResourceW" with parameter "1578852723696" - (UID: 00000000-00007184)26:T11c4,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74377152'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74363056'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74374792'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74372352'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74372232'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74363488'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74363528'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74363568'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74363608'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376552'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376472'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376632'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376432'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74377032'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376872'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376952'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376352'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74365472'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376392'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376592'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376792'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376712'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376112'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74376232'}" (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadResource with parameter {'hModule': '13107200', 'hResInfo': '74375992'}" (UID: 00000000-00007184)27:T437,Found string "The credential consists of both Password and UserName being supplied together in a pair." (Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "VPN.UserName=" (Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "providerFilter=Yes VPN.UserName="UserXXX"" (Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "ystem.Identity.QualifiedUserName" (Source: "00000000-00007184.00000000.130388.98C00000.00000002.mdmp") Found string "ystem.Identity.UserName" (Source: "00000000-00007184.00000000.130388.98C00000.00000002.mdmp") Found string "ystem.UserName" (Source: "00000000-00007184.00000000.130388.98C00000.00000002.mdmp") Found string "System.Identity.UserName" (Source: "00000000-00007184.00000001.132310.98C60000.00000002.mdmp") Found string "System.Identity.QualifiedUserName" (Source: "00000000-00007184.00000001.132310.98C60000.00000002.mdmp") Found string "System.UserName" (Source: "00000000-00007184.00000001.132310.98C60000.00000002.mdmp")28:T487,Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007184-00000C2C-1036604645") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007184-00000C2C-1036604685") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00007184-00000C2C-1036604965") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00007184-00000C2C-1036604989") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007184-00000C2C-1036605190") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007184-00000C2C-1036606075") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00007184-00000C2C-1036608262") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00007184-00000C2C-1036609200") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00007184-00000C2C-1036609383") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00007184-00000C2C-1036609663")29:T157e,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000ffbd9bbd000000000000000000000000207b39dffc7f0000630c0000ffff23000000000000000000000000000000000018000000ff7f0000000000000000000000000000000000000000000000000000ff77c8000000000020fbeffa2700000083ac37dffc7f00008789c9000000000085a9f9fdfc7f000000000bfffc7f000068000000fc7f00003c269d946f010000be5afefdfc7f00008c259d946f010000000000000000000000000000000000000000000000000000300ade010000000049c8c900000000000000000000000000030000000000000002000000d8210000000001000600004f (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000c80200000000000000000000000038fbeffa27000000c823c9000000000002000000000000001c24c9000000000000000000000000007b18d00000000000000000000000000008da9d946f010000d0bfc802000000000001000000000000c0faeffa27000000eee2d20000000000300ade0100000000c0faeffa270000000000000000000000b0faeffa2700000070f1d1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300ade01000000000000000000000000 (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000020f9effa27000000e688c80000000000f811be00375f00001604c9000000000030faeffa27000000862efbfdfc7f000006000000000000000000000000000000ffffffff00000000b6fdc8000000000030faeffa27000000c027fbfdfc7f0000c07e3bdffc7f000018ba3adffc7f0000c07e3bdffc7f000080228a966f010000c0f9effa2700000010faeffa270000000c0000000000000010da87966f010000ffffffff0000000000000000000000000000000000000000000000000000000020faeffa27000000cefcc800000000000000000000000000000000000000000090faeffa270000003499c800000000000000000000000000 (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000094d98401fd7f0000010000006f0100000d0000c0000000000100f7976f0100000d0000c0000000000300000000000000030000000000000050b8effa27000000300000000000000010b7effa2700000030ad8401fd7f0000000000000000000000000000000000009805f7976f0100004a0100000000000030b5effa2700000050b5effa27000000eeee0000000000000000000009040000300000000000000009040000000000000100000000000000000000000000000000000000000000000000000000000000e808f7976f01000000b9effa27000000700bf7976f01000048b8effa270000000000000000000000ffffffff6f01000000000000 (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000089966f01000030f27a966f01000080f9effa27000000cf85c800000000000000000000000000000000000000000000000000000000000501000000000000050100000000000048faeffa27000000200000000000000020000000000000000000000000000000000000000000000020faeffa270000009d99c80000000000000000000000000030168701fd7f0000e8369d946f010000859d8a01fd7f0000a0369d946f01000018fbeffa2700000020000000000000000644c90000000000f810be00375f000000000bfffc7f00000000000000000000d8b6fcfdfc7f00000000000000000000d0c389966f01000018fbeffa2700000000000bfffc7f0000 (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000028ceeffa27000000e4cdeffa27000000c0c7bf00fd7f00000000000000000000f2849700fd7f000000000000000000000100000000000000ffffffff00000000ec829700fd7f0000ffffffff00000000a01f000000000000b0d8a4946f0100000100000000000000c0c7bf00fd7f0000dc529700fd7f0000900ea0946f01000000d9a4946f010000b01da9946f01000000d9a4946f010000000000000000000053004f0046005400480000000000000001000000fd7f00000000000000000000f0eca4946f0100000100000000000000b01da9946f01000000000000010000000036ab946f010000010000000000000088d1effa27000000b01da994 (UID: 00000000-00007184)2a:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp")2b:T485,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "CreateDirectoryW" with parameter %TEMP%\809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.madExcept (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "CreateDirectoryW" with parameter C:\DarkGate7 (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "CreateDirectoryW" with parameter C:\DarkGate7\Downloader (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "CreateDirectoryW" with parameter C:\DarkGate7\Config (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "CreateDirectoryW" with parameter C:\DarkGate7\Config\Tools (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "CreateDirectoryW" with parameter %APPDATA%\DarkGate7 (UID: 00000000-00007184)2c:T165b,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter winspool.drv (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter FaultRep.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter WS2_32.DLL (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter Fwpuclnt.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter IdnDL.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter Normaliz.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007184) "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" called "LoadLibrary" with a parameter windowscodecs.dll (UID: 00000000-00007184)2d:Ta82,Found reference to API (Indicator: "GetProcAddress"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "ExitProcess"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "LoadLibraryA"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "VirtualProtect"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "FreeSid"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "NetWkstaGetInfo"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "IsEqualGUID"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "VariantInit"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "GetDC"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "VerQueryValueW"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "WinHttpOpen"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "NetWkstaGetInfo"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "IsEqualGUID"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "VariantInit"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp")2e:Tb5d,"e\Software\C" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "ACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64s" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp 00000000-00007184.00000001.132310.949D0000.00000004.mdmp 00000000-00007184.00000002.134227.949D0000.00000004.mdmp 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00007184.00000000.130388.98A40000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00007184.00000000.130388.98A40000.00000002.mdmp2f:T146b,"e\Software\C" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "ACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64s" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00007184.00000000.130388.949D0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00007184.00000000.130388.98A40000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00007184.00000000.130388.98A40000.00000002.mdmp "e\Software\C" in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "ACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64s" in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00007184.00000001.132310.949D0000.00000004.mdmp "e\Software\C" in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "ACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64s" in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00007184.00000002.134227.949D0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "e\Software\C" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "ACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64s" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00007184.00000003.139733.949D0000.00000004.mdmp30:T188a,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffce8d60000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "KERNEL32.DLL" at base 7ffcff0b0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "ADVAPI32.DLL" at base 7ffd00ef0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "COMCTL32.DLL" at base 7ffced3d0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "COMDLG32.DLL" at base 7ffd00fa0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "GDI32.DLL" at base 7ffd00ea0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "MSVCRT.DLL" at base 7ffd00d70000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "NETAPI32.DLL" at base 7ffcf5dc0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "OLE32.DLL" at base 7ffcff340000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "OLEAUT32.DLL" at base 7ffd010b0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "SHELL32.DLL" at base 7ffcff500000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "USER32.DLL" at base 7ffd015d0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "VERSION.DLL" at base 7ffcf56f0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "WINHTTP.DLL" at base 7ffcfa3e0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "WINMM.DLL" at base 7ffcf5f50000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "WINSPOOL.DRV" at base 7ffcf8e80000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "WSOCK32.DLL" at base 7ffcf5130000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 7ffcfdf70000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "FAULTREP.DLL" at base 7ffce5770000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffcfc1c0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "MSCTF.DLL" at base 16f96bf0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "IMM32.DLL" at base 7ffd00e10000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "WTSAPI32.DLL" at base 7ffcf97b0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "NTDLL.DLL" at base 7ffd01830000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "RPCRT4.DLL" at base 7ffd00c50000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "UXTHEME.DLL" at base 7ffcfc1c0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "WKSCLI.DLL" at base 7ffcf9880000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "CSCAPI.DLL" at base 7ffcf1fd0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "DWMAPI.DLL" at base 7ffcfc430000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "GDIPLUS.DLL" at base 7ffcdcae0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffcdcae0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "COLORUI.DLL" at base 7ffcd9c90000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "COMPSTUI.DLL" at base 7ffce5200000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "INETRES.DLL" at base 16f96d80000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "SHCORE.DLL" at base 7ffcfed70000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "MSIMG32.DLL" at base 7ffce8ea0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffcfa220000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "UXTHEME" at base 7ffcfc1c0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "USER32" at base 7ffd015d0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "WS2_32.DLL" at base 7ffcff490000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "FWPUCLNT.DLL" at base 7ffcf6d50000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "IDNDL.DLL" at base 7ffce8e90000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "NORMALIZ.DLL" at base 7ffcfed60000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "IPHLPAPI.DLL" at base 7ffcfd1a0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "%WINDIR%\SYSTEM32\FIREWALLAPI.DLL" at base 7ffcfcbe0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "SSPICLI.DLL" at base 7ffcfda80000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 16f96bf0000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 7ffcf9400000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "WINDOWSCODECS.DLL" at base 7ffcf9400000 "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffcff34000031:T518,file/memory contains long string(Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions" (Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "Outlook Attachment" (Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator." (Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found string "ystem.IsAttachment" (Source: "00000000-00007184.00000000.130388.98C00000.00000002.mdmp") Found string "ystem.Message.AttachmentContents" (Source: "00000000-00007184.00000000.130388.98C00000.00000002.mdmp") Found string "ystem.Message.AttachmentNames" (Source: "00000000-00007184.00000000.130388.98C00000.00000002.mdmp") Found string "ystem.Message.HasAttachments" (Source: "00000000-00007184.00000000.130388.98C00000.00000002.mdmp") Found string "System.IsAttachment" (Source: "00000000-00007184.00000001.132310.98C60000.00000002.mdmp")32:T936,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")33:T1002,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "809A49E7D55CCDFB06509FD21A907F12BE24C7D43AE6941D35C1A54BA58E549E"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")34:T822,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\809A49E7D55CCDFB06509FD21A907F12BE24C7D43AE6941D35C1A54BA58E549E.EXE.LOCAL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe.Local\" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\comctl32.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\comctl32.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\NETAPI32.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\netapi32.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\Windows\System32\netapi32.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\WINDOWS\SYSTEM32\netapi32.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\VERSION.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\version.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\Windows\System32\version.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\WINDOWS\SYSTEM32\version.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\WINHTTP.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\winhttp.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to touch file "C:\Windows\System32\winhttp.dll"35:Ta36,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\NETAPI32.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\netapi32.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\VERSION.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\version.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\WINHTTP.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\winhttp.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\WINMM.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\winmm.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\WSOCK32.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\wsock32.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\WINMMBASE.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\BCRYPT.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\bcrypt.dll" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\FLTLIB.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\MSVCP140.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\SAMCLI.DLL"36:T544,"809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\809A49E7D55CCDFB06509FD21A907F12BE24C7D43AE6941D35C1A54BA58E549E.EXE.LOCAL" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe.Local\" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\winspool.drv" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\DARKGATE7" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\DarkGate7\CONFIG" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DARKGATE7" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DarkGate7\HWID" "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DarkGate7\LOGIN.INI"37:T893,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007184-00000C2C-1036632977") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00007184-00000C2C-1036633069") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007184-00000C2C-1036633113") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007184-00000C2C-1036633132") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007184-00000C2C-1036633132") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007184-00000C2C-1036633132") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007184-00000C2C-1036633290") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007184-00000C2C-1036633290") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007184-00000C2C-1036668648") Found reference to API "Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7" (Indicator: "InternetOpen"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8" (Indicator: "InternetConnect"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13" (Indicator: "HttpOpenRequest"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "WSAStartup"; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007184.00000001.132310.046EB000.00000004.mdmp")38:T12a1,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007184-00000C2C-1036668648") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00007184-00000C2C-1036668679") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00007184-00000C2C-1036668716") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00007184-00000C2C-1036668841") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00007184-00000C2C-1036668902") Found reference to API "Can not set property at runtime.rCan't move focus to the control because it is invisible, not enabled, or of a type that does not accept the focus." (Indicator: " accept "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "and will send the form data without encrypting it for privacy." (Indicator: " send "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") file/memory contains long string with (Indicator: " listen "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") file/memory contains long string with (Indicator: " accept "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "CIM datetime type does not accept more than 99999999 days." (Indicator: " accept "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "and it tried to send again the message, but the configuration changed and the new settings did not allow the message to be re-sent." (Indicator: " send "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "Create a WinRM listener on %1://%2 to accept WS-Man requests to any IP on this machine." (Indicator: " accept "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "Created a WinRM listener on %1://%2 to accept WS-Man requests to any IP on this machine." (Indicator: " accept "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "The Windows Remote Shell cannot process the request. The WS-Addressing action URI is invalid. The valid actions are Command, Receive, Send and Signal." (Indicator: " send "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "The WS-Management service cannot accept subscriptions to an indication class, when either the filter or the dialect is specified." (Indicator: " accept "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "The WS-Management service cannot complete the request because the receiver does not accept the delivery of events." (Indicator: " accept "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "encoding limit. Reconfigure the client to send messages which fit the encoding limits of the service." (Indicator: " send "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "* is used to indicate that the service should listen on all available IPs on the machine." (Indicator: " listen "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "When * is used, other ranges in the filter are ignored. If filter is blank, the service doesn't listen on any address." (Indicator: " listen "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "For example, if service should be restricted to listen on only IPv4 addresses, IPv6 filter should be left empty." (Indicator: " listen "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found reference to API "Verify that the WS-Management service is running on the remote host and configured to listen for requests on the correct port and HTTP URL." (Indicator: " listen "; Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp")39:T401e,Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007184.00000000.130388.949D0000.00000004.mdmp") Found URL "https://npcap.com/'" - Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00007184.00000000.130388.98A40000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00007184.00000000.130388.9AD20000.00000004.mdmp") Found URL "http://______/decoy.pdf" - Source: "00000000-00007184.00000000.130388.9AE60000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007184.00000001.132310.949D0000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007184.00000002.134227.949D0000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007184.00000003.139733.949D0000.00000004.mdmp") Found URL "https://npcap.com/