34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 52:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T439,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 90264c1c86ee… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 90264c1c86ee…. Threat score 100/100. 0/28 AV engines flagged this file. 5 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/90264c1c86ee2c5afb029349eb6445c1defa8d5ac9fe50bd1c76cd9c966eb836","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","90264c1c86ee2c5afb029349eb6445c1defa8d5ac9fe50bd1c76cd9c966eb836"],"about":{"@type":"SoftwareApplication","name":"Alien_Isolation_TR_Yama_v1.00.exe","applicationCategory":["peexe","executable"],"identifier":"90264c1c86ee2c5afb029349eb6445c1defa8d5ac9fe50bd1c76cd9c966eb836","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T3355,Found XOR loop in file "nsDialogs.dll" at offset 3077; code bytes = 8030 Found XOR loop in file "newadvsplash.dll" at offset 7715; code bytes = 30d0 Found XOR loop in file "newadvsplash.dll" at offset 1861; code bytes = 8030 Found XOR loop in file "newadvsplash.dll" at offset 1981; code bytes = 8030 Found XOR loop in file "newadvsplash.dll" at offset 3231; code bytes = 8030 Found XOR loop in file "newadvsplash.dll" at offset 3641; code bytes = 8030 Found XOR loop in file "newadvsplash.dll" at offset 3846; code bytes = 8030 Found XOR loop in file "WebCtrl.dll" at offset 5329; code bytes = 30d0 Found XOR loop in file "WebCtrl.dll" at offset 5294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 69075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 84338; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 160671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 248897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 478735; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 509680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 567936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 590288; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 697295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 991576; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1037495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1142461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1148733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1207459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1216299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1220694; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1375736; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1692471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1749448; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1775216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1777195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1928382; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1967271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2060646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2077878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2088497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2184199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2223804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2225478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2255706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2260322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2271377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2344309; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2367658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2450702; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2551605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2584982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2608981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2738151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2882487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2958598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3055069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3077198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3166152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3170556; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3231765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3264112; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3303270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3353046; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3374866; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3576771; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3620346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3802426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3835522; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3872052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3873205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 181568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 215514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 325517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 432346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 496746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 525926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 543328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 555355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 629119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 635676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 744532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 924469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 948117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1059436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1239634; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1273325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1273514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1294659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1386445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1388388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1476832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1538446; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1580516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1629643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1735885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1873493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1904240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1933049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2017356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2233881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2337913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2470940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2494844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2548295; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2659686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2723694; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2802620; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2833533; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2845754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2934782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2958554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2969061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3148050; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3425272; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3455079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3462196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3622027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3758606; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3862121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3889619; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3969362; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 27848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 157979; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 271284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 290959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 417594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 424396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 450738; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 682024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 797982; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 825581; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 897415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 916036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 936719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 964886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 978717; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1010468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1159912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1290458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1401723; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1518675; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1567852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1602529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1611504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1674420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1703241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1742387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1851353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1857086; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1907740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1940958; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2059415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2130899; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2184198; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2191209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2255584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2421159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2440314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2554324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2588599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2624952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2702238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2768878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2788461; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2800803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2827046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3011609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3044895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3058887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3181513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3188363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3208455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3232872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3257282; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3352293; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3464603; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3544596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3914975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3984504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3988440; code bytes = 803037:T2641,"Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004b00140000000800140000006200000000007b23718feb05d8da0000040030df0e8a489e1900b0e8d0770bb61badfeffffff589e1900307262000000f07530faf873d447cd77c547cd77bb05d8da0000000080c3f973c3b49b4b4c9e1900dca01900b0ac0d74ffffffff8c9e190072faf873dca019007cceea7372faf8730100000000000000020000007cceea73c09e19000000000080c3f97380faf87300000000e8a019007c0b057610aa1176f7b49b4b (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000190050187b7365bdd7fcfeffffffc49a19008e667973589a190001deb28fffffffff00000000f766797301000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffff13b09b4b9c9a1900e89d1900b0ac0d74ffffffffdc9a190072faf873b1cacd777cceea7372faf8730100000000000000020000007cceea73089b190044a11900cce26b0080faf8731c9b190040000000d0074b000000000047b09b4b (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000001f00f82f6c000c306c0020000000d0074b0000004b00200000000000000000006200e04768000000000000000000000000000200000020000000c8014b00000000000400000000004b00120000000000000000006200d3b79b4b5c9d1900f09d1900b0ac0d74ffffffff989d190072faf873120000007cceea7372faf8730100000000000000020000007cceea73c49d19007c396c000000000080faf87310000000fcffffff00000000989d1900 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000d8dafefffffff43f19006866807602000000000000001440190095d68476340000c0301c47720000000000000000340000c0a358877640411900bcd28476acfb4672f4ab5271a25887763c4019000001000000000000fed284760000000000000000104019005900cf772c42190050187b73a5bdd7fcfeffffff60411900abdbd8da20eb1cf860411900fcef797302000000301c4772b46152710ff079732c421900020000004e000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000007b7100000000fd397b7100c5df0500c0e40540377b71b02e377100000000008ce20580c8e00580c0e40557377b7101000000008ce2050100000080c0e405e3a69a7180c8e0050200000044ee1900602f7b7180c8e00540a5e00500c0e40500c0e40590a69a71dcee1900182b7b71692b7b7100000000ce2b7b7100000000c0ee1900000000000000000080c8e00500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001300000000000000c0ee1900000000000000000000c0e40500c0e4050000000000000000acca168b00000000 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004b0014000000080014000000620004084b000000000000084b0020bd1900febacd77080014000000000008000000050000006cbd1900f0bd027600006200080014001400000040d2cf83008000000a00000005000000db979b4b64bd1900f4bf1900b0ac0d74ffffffffa4bd190072faf87398bd19007cceea7372faf8730100000000000000020000007cceea73d8bd19000000000080c3f97380faf873b87e6d006cc419006ec419002c6fd6830f979b4b (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000001fc1d0000a8567000000000000000000054ba1900b0e8d0777bb41badfeffffffbcb919006dfcd1770000000094fcd17798566f000000620098566f00000000000000000000000000000000001800000075fdb28f2b939b4bb4b9190000bd1900b0ac0d74fffffffff4b9190072faf87314ba19007cceea7372faf8730100000000000000020000007cceea7320ba19005cc01900346d6e0080faf873f0b91900b0847b7300006200000000005f939b4b (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000002e00582d6f006c2d6f0020000000d0074b0000004b0018bddb77000000004cbc190060566d00000000000000000000004b000200000020000000c8014b00000000000400000000004b00120000000000000000006200eb969b4b74bc190008bd1900b0ac0d74ffffffffb0bc190072faf873120000007cceea7372faf8730100000000000000020000007cceea73dcbc19007c396c000000000080faf87310000000fcffffff00000000b0bc1900 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004b0014000000080014000000620004084b000000000000084b00507b1900febacd77080014000000000008000000050000009c7b1900f0bd0276000062000800140014000000b014cf83008000000a000000050000000b519b4b947b1900247e1900b0ac0d74ffffffffd47b190072faf873c87b19007cceea7372faf8730100000000000000020000007cceea73087c19000000000080c3f97380faf873180571009c8219009e8219002c6fd6833f519b4b (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000001c40d000058007007000000000000000084781900b0e8d0777bb41badfeffffffec7719006dfcd1770000000094fcd17748006f070000620048006f0700000000000000000000000000000000180000002533b28f5b5d9b4be4771900307b1900b0ac0d74ffffffff2478190072faf873447819007cceea7372faf8730100000000000000020000007cceea73507819008c7e19004cee6d0080faf87320781900b0847b7300006200000000008f529b4b (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000200582d6f006c2d6f0020000000d0074b0000004b00200000000000000000006200a0576d000000000000000000000000000200000020000000c8014b00000000000400000000004b001200000000000000000062001b509b4ba47a1900387b1900b0ac0d74ffffffffe07a190072faf873120000007cceea7372faf8730100000000000000020000007cceea730c7b1900f48170000000000080faf87310000000fcffffff00000000e07a1900 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000700040bc1900000000002f75cf7719028c707800000000000000980600000000000019028c70000000003900190510bc190000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000000086700000000030bc190000800000000000000000000000000000000000000000000000000000980600000000000019028c70000000003900190510bc1900b025cd770000867020f36b0030bc190018bc19006745cd770cd3db7700000000000000000000000000000000000000002da3cf7700000000010000000800000020f36b0044bc1900826904760000867000000000 (UID: 00000000-00009060)38:T117d,"Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter SHFOLDER (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter %TEMP%\nsa3F8A.tmp\System.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter %TEMP%\nsa3F8A.tmp\newadvsplash.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter RichEd20 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter %TEMP%\nsa3F8A.tmp\nsDialogs.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter %TEMP%\nsa3F8A.tmp\Delay.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter %TEMP%\nsa3F8A.tmp\WebCtrl.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter msIso.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter MSHTML.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter mshtml.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter ieframe.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter ext-ms-win-ntuser-touch-hittest-l1-1-0.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "LoadLibrary" with a parameter api-ms-win-rtcore-ntuser-wmpointer-l1-1-0.dll (UID: 00000000-00009060)39:T859f,"Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CompareFileTime (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SearchPathA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetShortPathNameA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter MoveFileA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetTempFileNameA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter WritePrivateProfileStringA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetPrivateProfileStringA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegEnumKeyA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegDeleteKeyA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegDeleteValueA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ImageList_AddMasked (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ImageList_Destroy (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ImageList_Create (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateBrushIndirect (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateFontIndirectA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHBrowseForFolderA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHGetFileInfoA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHFileOperationA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetClassLongA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetWindowLongA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CheckDlgButton (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetMessagePos (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter LoadBitmapA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegisterClassA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter TrackPopupMenu (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter AppendMenuA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreatePopupMenu (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetDlgItemTextA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetDlgItemTextA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter MessageBoxIndirectA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CharPrevA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter PeekMessageA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateDialogParamA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetWindowTextA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter PostQuitMessage (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SendMessageTimeoutA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FindWindowExA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SystemParametersInfoA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetClassInfoA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter DialogBoxParamA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CharNextA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ExitWindowsEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetWindowLongA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter LoadImageA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter DrawTextA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter show (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter Create (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetRTL (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateControl (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter LoadImage (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter Show (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter DelayButton (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ShowWebInCtrl (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter VariantToStringWithDefault (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IUnknown_SetSite (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateURLMonikerEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CreateAsyncBindCtxEx (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegisterBindStatusCallback (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter UrlMkGetSessionOption (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoInternetIsFeatureEnabled (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetCoalescableTimer (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ProgIDFromCLSID (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter TravelLogCreateInstance (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RtlIsMultiSessionSku (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RevokeBindStatusCallback (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHGetValueW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RegisterTouchHitTestingWindow (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ResolveDelayLoadsFromDll (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryBinaryBlob (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoInternetQueryInfo (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHCreateMemStream (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IStream_Reset (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IStream_Size (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IStream_Read (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CommitUrlCacheEntryBinaryBlob (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FindFirstUrlCacheContainerA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHAnsiToUnicode (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FindNextUrlCacheContainerA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter FindCloseUrlCache (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CommitUrlCacheEntryW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHUnicodeToAnsi (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryInfoW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryInfoExW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetDCDpiScaleValue (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SetThreadDpiAwarenessContext (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter GetCurrentInputMessageSource (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter InternetSetOptionW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter SHDeleteValueW (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ExtractIcon (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter ExtractIconA (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter OnClick (UID: 00000000-00009060) "Alien_Isolation_TR_Yama_v1.00.exe" called "GetProcAddress" with a parameter OnChange (UID: 00000000-00009060)3a:T411,Found reference to API (Indicator: "LoadLibraryA"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "VirtualProtect"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "VirtualFree"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "ExitProcess"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "RegEnumKeyA"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "GetDC"; File: "Alien_Isolation_TR_Yama_v1.00.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "Alien_Isolation_TR_Yama_v1.00.exe")3b:T56a,Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9060:168:WilStaging_02" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9060:64:WilError_03" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "\Sessions\1\BaseNamedObjects\Alien Isolation_Türkçe_Yama_v1.00" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9060:64:WilError_03" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "Local\SM0:9060:168:WilStaging_02" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "SM0:9060:64:WilError_03" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "Local\ZonesCacheCounterMutex" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "Local\SM0:9060:64:WilError_03" Process Alien_Isolation_TR_Yama_v1.00.exe created mutex with name "Alien Isolation_Türkçe_Yama_v1.00"3c:T185f,"Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75f00000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75f00000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75f00000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "KERNEL32" at base 767f0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "KERNEL32.DLL" at base 767f0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "ADVAPI32.DLL" at base 75cb0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "COMCTL32.DLL" at base 75710000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "GDI32.DLL" at base 77bf0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "OLE32.DLL" at base 76bd0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "SHELL32.DLL" at base 77580000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "USER32.DLL" at base 77280000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "VERSION.DLL" at base 75980000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75190000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "SHFOLDER" at base 736a0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%TEMP%\NSA3F8A.TMP\SYSTEM.DLL" at base 10000000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%TEMP%\NSA3F8A.TMP\NEWADVSPLASH.DLL" at base 2440000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 74a70000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\ASYCFILT.DLL" at base 73680000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "RPCRT4.DLL" at base 774c0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "SSPICLI.DLL" at base 74680000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75f00000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "VIRTDISK.DLL" at base 74e30000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75d30000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76fa0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 77280000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 77280000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75cb0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76bd0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "RICHED20" at base 731a0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%TEMP%\NSA3F8A.TMP\NSDIALOGS.DLL" at base 25a0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%TEMP%\NSA3F8A.TMP\DELAY.DLL" at base 720000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%TEMP%\NSA3F8A.TMP\WEBCTRL.DLL" at base 870000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 729d0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 77080000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 728a0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "PROPSYS.DLL" at base 74740000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74740000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75a30000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "MSISO.DLL" at base 72680000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "URLMON.DLL" at base 74a70000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "CRYPTBASE.DLL" at base 73220000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSWOW64\MSHTML.DLL" at base 71370000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "MSHTML.DLL" at base 71370000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "WLDP.DLL" at base 73c90000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 768e0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 71280000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "IEFRAME.DLL" at base 729d0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\MSIMTF.DLL" at base 71270000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "EXT-MS-WIN-NTUSER-TOUCH-HITTEST-L1-1-0.DLL" at base 77280000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 71160000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSWOW64\JSCRIPT9.DLL" at base 70d90000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "NTDLL.DLL" at base 77c90000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "SECUR32.DLL" at base 71160000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "MLANG.DLL" at base 71280000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "WININET.DLL" at base 75260000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "D3D10WARP.DLL" at base 6fe00000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75a30000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 75a30000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75a30000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 76fa0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "DWRITE.DLL" at base 70640000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "API-MS-WIN-RTCORE-NTUSER-WMPOINTER-L1-1-0.DLL" at base 77280000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 6fde0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6fde0000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74520000 "Alien_Isolation_TR_Yama_v1.00.exe" loaded module "COMCTL32" at base 757100003d:T568,"Alien_Isolation_TR_Yama_v1.00.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Alien_Isolation_TR_Yama_v1.00.exe" was detected as "UPX" and name: "Packer" "Alien_Isolation_TR_Yama_v1.00.exe" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "UPX" and name: "Packer" "System.dll" was detected as "Microsoft Linker" and name: "Linker" "nsDialogs.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsDialogs.dll" was detected as "UPX" and name: "Packer" "nsDialogs.dll" was detected as "Microsoft Linker" and name: "Linker" "newadvsplash.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "newadvsplash.dll" was detected as "UPX" and name: "Packer" "newadvsplash.dll" was detected as "Microsoft Linker" and name: "Linker" "Delay.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Delay.dll" was detected as "UPX" and name: "Packer" "Delay.dll" was detected as "Microsoft Linker" and name: "Linker" "WebCtrl.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "WebCtrl.dll" was detected as "UPX" and name: "Packer" "WebCtrl.dll" was detected as "Microsoft Linker" and name: "Linker"3e:T68b,"Alien_Isolation_TR_Yama_v1.00.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Alien_Isolation_TR_Yama_v1.00.exe" touched "Microsoft Web Browser" (Path: "HKCU\WOW6432NODE\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\TREATAS") "Alien_Isolation_TR_Yama_v1.00.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "Alien_Isolation_TR_Yama_v1.00.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Alien_Isolation_TR_Yama_v1.00.exe" touched "Shell DocObject Viewer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}\INPROCSERVER32") "Alien_Isolation_TR_Yama_v1.00.exe" touched "HTML Document" (Path: "HKCU\WOW6432NODE\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\TREATAS") "Alien_Isolation_TR_Yama_v1.00.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\WOW6432NODE\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "Alien_Isolation_TR_Yama_v1.00.exe" touched "Multi Language Support" (Path: "HKCU\WOW6432NODE\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "Alien_Isolation_TR_Yama_v1.00.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\WOW6432NODE\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "Alien_Isolation_TR_Yama_v1.00.exe" touched "JScript Language" (Path: "HKCU\WOW6432NODE\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "Alien_Isolation_TR_Yama_v1.00.exe" touched "History" (Path: "HKCU\WOW6432NODE\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\INSTANCE")3f:Taff,"System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nsa3F8A.tmp\System.dll]- [targetUID: 00000000-00009060] "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\nsa3F8A.tmp\nsDialogs.dll]- [targetUID: 00000000-00009060] "newadvsplash.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nsa3F8A.tmp\newadvsplash.dll]- [targetUID: 00000000-00009060] "Delay.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nsa3F8A.tmp\Delay.dll]- [targetUID: 00000000-00009060] "WebCtrl.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nsa3F8A.tmp\WebCtrl.dll]- [targetUID: 00000000-00009060] "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 164 x 314 x 24 image size 154490 resolution 3936 x 3936 px/m cbSize 154544 bits offset 54"- Location: [%TEMP%\nsa3F8A.tmp\modern-wizard.bmp]- [targetUID: 00000000-00009060] "banner.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 100x100 segment length 16 Exif Standard: [TIFF image data little-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS4 Windows datetime=2014:11:27 23:51:00] baseline precision 8 563x317 components 3"- Location: [%TEMP%\nsa3F8A.tmp\banner.jpg]- [targetUID: 00000000-00009060] "modern-header.bmp" has type "PC bitmap Windows 3.x format 499 x 57 x 24 image size 85502 resolution 2834 x 2834 px/m cbSize 85556 bits offset 54"- Location: [%TEMP%\nsa3F8A.tmp\modern-header.bmp]- [targetUID: 00000000-00009060] "splash.gif" has type "GIF image data version 89a 333 x 423"- Location: [%TEMP%\nsa3F8A.tmp\splash.gif]- [targetUID: 00000000-00009060] "nscE884.tmp" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- Location: [%TEMP%\nsa3F8A.tmp\nscE884.tmp]- [targetUID: 00000000-00009060] "nsnE874.tmp" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- Location: [%TEMP%\nsa3F8A.tmp\nsnE874.tmp]- [targetUID: 00000000-00009060] "oku.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsa3F8A.tmp\oku\oku\oku.html]- [targetUID: 00000000-00009060] "scroll.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsa3F8A.tmp\oku\scroll.html]- [targetUID: 00000000-00009060] "oku.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsa3F8A.tmp\oku\oku.html]- [targetUID: 00000000-00009060] "scroll.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsa3F8A.tmp\scroll.html]- [targetUID: 00000000-00009060]40:T522,"Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "")41:Taea,"Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "ALIEN_ISOLATION_TR_YAMA_V1.00.EXE"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "")42:T636,"Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Alien_Isolation_TR_Yama_v1.00.exe" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\rpcrt4.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\advapi32.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll"43:T951,"Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\SHFOLDER.DLL" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\CFGMGR32.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\System.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\newadvsplash.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\WINMM.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\RichEd20.DLL" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\USP10.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\msls31.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\nsDialogs.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\TextShaping.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\Delay.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\MSVCP60.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\WebCtrl.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\msIso.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll.DLL" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Secur32.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\WININET.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\profapi.dll" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\d3d10warp.dll"44:T7df,"Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\scroll.html" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\splash.gif" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\banner.jpg" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\oku\scroll.html" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\oku\oku\oku.html" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\oku\oku.html" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\splash.gif:Zone.Identifier" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\banner.jpg:Zone.Identifier" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\modern-header.bmp" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\modern-wizard.bmp" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Alien_Isolation_TR_Yama_v1.00.exe.Local\" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\PROPSYS.dll.mui" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\ieframe.dll.mui" "Alien_Isolation_TR_Yama_v1.00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\scroll.html:Zone.Identifier"45:Tc0b,"Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Alien_Isolation_TR_Yama_v1.00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")46:T83c,"Alien_Isolation_TR_Yama_v1.00.exe" wrote 11264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Alien_Isolation_TR_Yama_v1.00.exe" wrote 8704 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\newadvsplash.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Alien_Isolation_TR_Yama_v1.00.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\nsDialogs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Alien_Isolation_TR_Yama_v1.00.exe" wrote 7168 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\Delay.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Alien_Isolation_TR_Yama_v1.00.exe" wrote 5632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsa3F8A.tmp\WebCtrl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...47:T52f,Found string "LoadLibraryA" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcAddress" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualProtect" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualAlloc" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualFree" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: KERNELBASE.DLL) Found string "ExitProcess" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: KERNEL32.DLL) Found string "RegEnumKeyA" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: ADVAPI32.DLL) Found string "SetBkMode" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: GDI32FULL.DLL) Found string "CoTaskMemFree" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: COMBASE.DLL) Found string "ShellExecuteA" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "GetDC" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: USER32.DLL) Found string "VerQueryValueA" (Source: Alien_Isolation_TR_Yama_v1.00.exe, API is part of module: VERSION.DLL)48:T6a8,"Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsj9592.tmp" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\System.dll" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\scroll.html" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\splash.gif" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\banner.jpg" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\oku\scroll.html" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\oku\oku\oku.html" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\oku\oku.html" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\newadvsplash.dll" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF7CA9385AED286968.TMP" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\lv9W2Js\AppData\Local\Temp\nsz95A3.tmp\newadvsplash.dll" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\modern-wizard.bmp" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsz95A3.tmp\nsDialogs.dll" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\lv9W2Js\AppData\Local\Temp\nsz95A3.tmp\nsDialogs.dll" "Alien_Isolation_TR_Yama_v1.00.exe" created file "C:\Users\lv9W2Js\AppData\Local\Temp\nsz95A3.tmp\System.dll"49:T6ed,"Alien_Isolation_TR_Yama_v1.00.exe" wrote bytes "7da3d77595a3d77582f3d67500d0d7750fa8d775f990d67587f1d77581a8d775bcced77585ded77513dbd77527f1d7758aa2d7751af1d7755ac6d775252ed77500000000173fab760000000008223a76d1e4377600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "Alien_Isolation_TR_Yama_v1.00.exe" wrote bytes "95a3d7750fa8d7757da3d77527f1d77500000000473f847728478477203f847700000000ad54ab76638baa7626a9aa76e7baaa76000000000fef377688354276d9ea3776bbd23d7600000000" to virtual address "0x04482000" "Alien_Isolation_TR_Yama_v1.00.exe" wrote bytes "c04e9c7720549d77e0659d77b5389e770000000000d0d77500000000c5ead7750000000088ead77500000000e968b77582289e77ee299e7700000000d269b775000000007dbbd7750000000009beb77500000000ba18d77500000000" to virtual address "0x76A31000" (part of module "NSI.DLL") "Alien_Isolation_TR_Yama_v1.00.exe" wrote bytes "e7399a77e1a69e772e719e77ee299e7785e299776da09e7790649d773ad5a47726e49977d16d9e77003d9c77804b9c7700000000ad379a768b2d9a76b6419a7600000000" to virtual address "0x752A1000" (part of module "WSHIP6.DLL") "Alien_Isolation_TR_Yama_v1.00.exe" wrote bytes "75dcca75273eca7551c1c875ee9cc8759498c8750fb3ce751099c8759097c8750000000042c6d775152ed775c0d9d7751bf7d775c108d975a0c4d77536dad77530c6d775d5d9d77586c4d77500000000" to virtual address "0x7097E000" (part of module "MSLS31.DLL") "Alien_Isolation_TR_Yama_v1.00.exe" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "Alien_Isolation_TR_Yama_v1.00.exe" wrote bytes "d055bf766473c8760000000051c1c8759498c875ee9cc87575dcca75273eca750fb3ce7500000000acdcd7751bf7d775c108d975c0d9d775152ed77536dad775d5d9d77530c6d775a0c4d77542c6d7751bc6d77586c4d77572c6d77500000000" to virtual address "0x73021000" (part of module "SHFOLDER.DLL")4a:T5a2,"System.dll" contains export function called "Alloc" at ordinal 1 "System.dll" contains export function called "Call" at ordinal 2 "System.dll" contains export function called "Copy" at ordinal 3 "System.dll" contains export function called "Free" at ordinal 4 "System.dll" contains export function called "Get" at ordinal 5 "System.dll" contains export function called "Int64Op" at ordinal 6 "System.dll" contains export function called "Store" at ordinal 7 "nsDialogs.dll" contains export function called "Create" at ordinal 1 "nsDialogs.dll" contains export function called "CreateControl" at ordinal 2 "nsDialogs.dll" contains export function called "CreateItem" at ordinal 3 "nsDialogs.dll" contains export function called "CreateTimer" at ordinal 4 "nsDialogs.dll" contains export function called "GetUserData" at ordinal 5 "nsDialogs.dll" contains export function called "KillTimer" at ordinal 6 "nsDialogs.dll" contains export function called "OnBack" at ordinal 7 "nsDialogs.dll" contains export function called "OnChange" at ordinal 8 "nsDialogs.dll" contains export function called "OnClick" at ordinal 9 "nsDialogs.dll" contains export function called "OnNotify" at ordinal 10 "nsDialogs.dll" contains export function called "SelectFileDialog" at ordinal 11 "nsDialogs.dll" contains export function called "SelectFolderDialog" at ordinal 12 "nsDialogs.dll" contains export function called "SetRTL" at ordinal 134b:T459,"XXX ProgramFilesDirC:\Program FilesCommonFilesDir\Common Files5'Ara' dmesine tklayn ve oyunun kurulum klasrn sein!\System.dllkernel32::CreateMutexA(i 0, i 0, t "Alien Isolation_Trke_Yama_v1.00") i .r1 ?eCall0Kurulum Program zaten alyor.Software\Microsoft\Windows\CurrentVersion\Uninstall\Alien Isolation TRHome\Alien Isolation Trke Yama Kaldr.exeAlien Isolation Trke Yama sisteminize daha nce kurulmu." "%dSoftware\Microsoft\Windows\CurrentVersion\Microsoft\Internet Explorer\Quick LaunchFFFtz`pu~lqtjyFyVydyryyyytxyyyzzz0z@zNz^zpzzzzzzfxZxNx2x$xxxwwwwwwpwTwHwyFyVydyryyyytxyyyzzz0z@zNz^zpzzzzzzfxZxNx2x$xxxwwwwwwpwTwHw