26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4dc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_100% Sample 9cd46027d63c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9cd46027d63c…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b","keywords":["Malicious","Win/grayware_confidence_100%","malware analysis","sandbox report","threat intelligence","9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b"],"about":{"@type":"SoftwareApplication","name":"TSP Dork generator hot edition.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_100%","antivirusDetections":{"malicious":1,"total":1},"behavioralIndicators":{"malicious":4,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6c3,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll.aux" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\b8de0f79bc74f6c423e1c719ee7afefd\Microsoft.VisualBasic.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\250e8e6af918e7ca66787117bc8633e3\System.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\75790ba48ebfa82fae7da9a114bc9886\System.Core.ni.dll.aux"28:T19d7,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007180-00000BC0-33395200") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp")29:Tf3a,"TSPDorkgeneratorhotedition.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000b68681bd7dcb00000800000000000000ffffffffffffffff3400000000000000f6055082fa7f000028eb2ff282000000db04daa4fa7f000000000000fa7f00002a9650a1fa7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000090eb2ff282000000080000000000000000000000000000000000000000000000267181bd7dcb0000c3f0d8a4fa7f0000000044a4fa7f0000a713d9a4fa7f0000e8eb2ff2 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5da3fa7f0000000000000000000051eddca4fa7f000000000000ea01000000000000000000003a04b07f7d1300002a00000000000000f0188598ea0100008fecdca4fa7f0000e0ac5da3fa7f0000e0ac5da3fa7f0000000000000000000000000000fa7f0000ffffff7f1906000000000000000000000000000000000000d8ce51a3fa7f00002a0000000000000069c30aa3fa7f00003100000000000000000300000000000004030000000000001100011000000000d0b62ff28200000003a393a2fa7f0000d0b62ff28200000000000000000000002b00000000000000000000000000000020b010a3fa7f0000b43f0fa3fa7f0000e0ce51a3 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e000d8a4fa7f00000000000000000000000000000000000000000000000000000000caa2fa7f00001ec4b182fa7f00005013b182fa7f00001844d3a2fa7f00002831d3a2fa7f0000fca2d3a2fa7f00000000a982fa7f000000000000fa7f0000f800a982fa7f000005000500000000008667d3a2fa7f00000000000000000000deb1dba4fa7f000001000000ea0100000000000000000000a0cd8598ea010000a8da2ff2820000007a64b07f7d13000051a7dba4fa7f00000500000000000000f800a982fa7f000001000000000000000000000000000000f0da2ff2820000001033e9a4fa7f000044df2ff2820000007964b082fa7f000000020000 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000c0c02ff28200000000000000000000000000000000000000f8bf2ff2820000000000000000000000000000000000000070fb7b9dfa7f00000900000009000000000000000000000019558580fa7f00000000000000000000180000008200000068c12ff28200000020001f9aea01000060c12ff28200000030c12ff282000000871d5082fa7f000058c22ff2820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000010000000000000060c12ff28200000030c12ff28200000078c12ff2820000008a0eb07f7d130000d65b81bd7dcb000032140000 (UID: 00000000-00007180)2a:T1f62,"TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\2ad5a08ac14a644f07b96713f8783236\System.Runtime.Remoting.ni.dl (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter RichEd20.DLL (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007180)2b:Tb4e1,"TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsThemePartDefinedW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetThemePartSizeW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipImageGetFrameDimensionsCount (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipImageGetFrameDimensionsList (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateFromHWND (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipMeasureString (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LoadIcon (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipBitmapLockBits (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipBitmapUnlockBits (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromStream (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGraphicsClear (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateImageAttributes (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesColorKeys (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRectI (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipDisposeImageAttributes (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetParent (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparentW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DrawThemeParentBackgroundW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DrawThemeBackgroundW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRectW (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCloneRegion (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipCombineRegionRectI (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GdipSetClipRegion (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter SetCapture (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter ReleaseCapture (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DragAcceptFiles (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007180)2c:T550,"TSPDorkgeneratorhotedition.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "TSPDorkgeneratorhotedition.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "TSPDorkgeneratorhotedition.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "TSPDorkgeneratorhotedition.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "TSPDorkgeneratorhotedition.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "TSPDorkgeneratorhotedition.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "TSPDorkgeneratorhotedition.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "TSPDorkgeneratorhotedition.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]2d:T1e19,"TSPDorkgeneratorhotedition.exe" loaded module "KERNEL32" at base a2a80000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base a4a10000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 82560000 "TSPDorkgeneratorhotedition.exe" loaded module "ADVAPI32.DLL" at base a29b0000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 89180000 "TSPDorkgeneratorhotedition.exe" loaded module "SHLWAPI.DLL" at base a4870000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base a10f0000 "TSPDorkgeneratorhotedition.exe" loaded module "VERSION.DLL" at base 991f0000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7aba0000 "TSPDorkgeneratorhotedition.exe" loaded module "USER32.DLL" at base a2ca0000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "TSPDorkgeneratorhotedition.exe" loaded module "MSCOREE.DLL" at base 89230000 "TSPDorkgeneratorhotedition.exe" loaded module "NTDLL" at base a4d80000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base a4a40000 "TSPDorkgeneratorhotedition.exe" loaded module "PSAPI.DLL" at base a2250000 "TSPDorkgeneratorhotedition.exe" loaded module "KERNEL32.DLL" at base a2a80000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 73880000 "TSPDorkgeneratorhotedition.exe" loaded module "RPCRT4.DLL" at base a2ed0000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "TSPDorkgeneratorhotedition.exe" loaded module "OLE32.DLL" at base a4520000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 9f750000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base a4a40000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 72c10000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 72190000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7e450000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 80a80000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 71f90000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 70ee0000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7bdf0000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 70630000 "TSPDorkgeneratorhotedition.exe" loaded module "NTDLL.DLL" at base a4d80000 "TSPDorkgeneratorhotedition.exe" loaded module "SHELL32.DLL" at base a2ff0000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "TSPDorkgeneratorhotedition.exe" loaded module "BCRYPT.DLL" at base a0bd0000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base a0510000 "TSPDorkgeneratorhotedition.exe" loaded module "IMM32.DLL" at base a4a10000 "TSPDorkgeneratorhotedition.exe" loaded module "COMCTL32.DLL" at base 82a90000 "TSPDorkgeneratorhotedition.exe" loaded module "GDI32.DLL" at base a4440000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNT73A1FC9D#\2AD5A08AC14A644F07B96713F8783236\SYSTEM.RUNTIME.REMOTING.NI.DLL" at base 81340000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "TSPDorkgeneratorhotedition.exe" loaded module "UXTHEME.DLL" at base 9f750000 "TSPDorkgeneratorhotedition.exe" loaded module "GDIPLUS.DLL" at base 80850000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 80850000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base a1180000 "TSPDorkgeneratorhotedition.exe" loaded module "OLEAUT32" at base a48e0000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "TSPDorkgeneratorhotedition.exe" loaded module "OLEAUT32.DLL" at base a48e0000 "TSPDorkgeneratorhotedition.exe" loaded module "RICHED20.DLL" at base 7e6f0000 "TSPDorkgeneratorhotedition.exe" loaded module "WINDOWSCODECS.DLL" at base 9d760000 "TSPDorkgeneratorhotedition.exe" loaded module "COMCTL32.DLL" at base 8fb20000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7aa30000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base a26b0000 "TSPDorkgeneratorhotedition.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base a2ca0000 "TSPDorkgeneratorhotedition.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base a2ca0000 "TSPDorkgeneratorhotedition.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base a4a40000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base a4520000 "TSPDorkgeneratorhotedition.exe" loaded module "COMCTL32" at base 8fb20000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 8b180000 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "TSPDorkgeneratorhotedition.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "TSPDorkgeneratorhotedition.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base a2a800002e:T49f,"TSP Dork generator hot edition.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2f:Tf79,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007180-00000C25-32950194] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007180-00000C25-33215731] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007180-00000C25-33272951] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007180-00000C25-33325488] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007180-00000C25-33380159] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007180-00000C25-33400734] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007180-00000C25-33432703] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007180-00000C25-33490362] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007180-00000C25-33509660] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00007180-00000C25-33533180] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00007180-00000C25-33574323] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00007180-00000C25-33596391] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00007180-00000C25-33622711] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00007180-00000C25-33737023] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00007180-00000C25-33757375] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007180-00000C25-34017717] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007180-00000C25-34348372] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007180-00000C25-34711804] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007180-00000C25-34889351] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007180-00000C25-34902424] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007180-00000C25-34915517] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll" [Source: 00000000-00007180-00000C25-35006948] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007180-00000C25-41040583] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" [Source: 00000000-00007180-00000C25-41110465]30:T7b5,"TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")31:Tc1e,"TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "TSPDorkgeneratorhotedition.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "TSPDORKGENERATORHOTEDITION"; Value: "")32:T5ae,"TSPDorkgeneratorhotedition.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "TSPDorkgeneratorhotedition.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "TSPDorkgeneratorhotedition.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.v9921e851#\fb4ba4db52ca77687f807bb068871ec2\microsoft.visualbasic.ni.dll.aux" "TSPDorkgeneratorhotedition.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "TSPDorkgeneratorhotedition.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "TSPDorkgeneratorhotedition.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\b138f79dea860272ebe6694d9b73f656\system.windows.forms.ni.dll.aux" "TSPDorkgeneratorhotedition.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\ece80f2e3752a779e894fd45d8f27e64\system.drawing.ni.dll.aux" "TSPDorkgeneratorhotedition.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "TSPDorkgeneratorhotedition.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"33:Tc87,"TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\CRYPTSP.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\CRYPTSP.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\CRYPTBASE.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\DWRITE.DLL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\DWrite.dll" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL"34:T6c4,"TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\TSPDORKGENERATORHOTEDITION.EXE.CONFIG" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TSPDORKGENERATORHOTEDITION.EXE.LOG" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\TSPDorkgeneratorhotedition.exe.config" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\TSP DORK GEAA08F154#" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\TSPDORKGENERATORHOTEDITION.INI" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\TSPDorkgeneratorhotedition.INI" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "\Device\HarddiskVolume2\TSPDORKGENERATORHOTEDITION.EXE.LOCAL" "TSPDorkgeneratorhotedition.exe" trying to access non-existent file "C:\TSPDorkgeneratorhotedition.exe.Local\"35:T99c,"TSPDorkgeneratorhotedition.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\TSP Dork geaa08f154#\* (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter fb4ba4db52ca77687f807bb068871ec2 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007180) "TSPDorkgeneratorhotedition.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007180)36:T1993,Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.98790000.00000004.mdmp, 00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007180.00000000.66512.98790000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007180.00000000.66512.98790000.00000004.mdmp, 00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.DpapiDataProtector, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp") Found string "System.Security.Cryptography.HashAlgorithm" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007180.00000000.66512.9A250000.00000004.mdmp")37:T82e,System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-600003c-extracted_dorks~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-60000ff-pageformats~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-600004b-extractor_panel~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-6000123-searchfunctions~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-6000135-settings_panel~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-6000027-dorktypes~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-600006f-Form1~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-6000015-domainextentions~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-6000041-extracted_keywords~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-6000046-extracted_pagetypes~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-60000dd-info_panel~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-600009d-generate_dorks_panel~InitializeComponent Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[]) at 8f8ff6b696859c3afe7936c345b098bd-60000d3-generate_dorks_panel~method_0 System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-6000111-pagetypes~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 8f8ff6b696859c3afe7936c345b098bd-60000ee-keywords~InitializeComponent38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3N3AAAAAAAAAAAAAAA3d4/4d3dwAAAAAAAAAAAHd3gAAzd3dwAAAAAAAAAAdwd4AAhwd3dwAAAAAAAAB3B48AAAB3d3dwAAAAAAAHcHjwAAAAAXd3eAAAAAAANweAAAAAAAF4d3fwAAAAAHN4BwAAAAADf3eHgAAAAANzcAcAAAAAAX8Hd3AAAAAHh4AXAAAAABl/AHd/AAAABzfwFwAAABEXeAB4fwAAAAcH8BcAAAAXdxEXeH8AAAAHB/AXAAAXePc3cXh/AAAABwfwBwAHePAAf3N3fwAAAAeHgAcAePAAAx8Bd38AAAAHcxAXBY8AAAMTF4B/AAAAB3ERNxeAAAAHM3eHgAAAAAB4N/8BeAAAB3cHN/AAAAAAd3N4ARdwAQdweHgAAAAAAAd3dzMREAB4N4N/AAAAAAAHd3d3cRF3c3g38AAAAAAAAHd3dzd3d3d3fwAAAAAAAAAHd3eId3hzd/AAAAAAAAAAAAh3dzd3d/8AAAAAAAAAAAAAD/+Ij/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////w////AB///AAH//gMA//wDgH/4B8A/+A/gH/A/4A/wH+AP8B/AD+AfAQfgHAAH4BAAB+AAAAfgADAH4ADwB+AB8AfwA/AP8AHAD/gAAB/4AAAf/AAAP/4AAH//AAD//8AB///wD////////////w==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3N3AAAAAAAAAAAAAAA3d4/4d3dwAAAAAAAAAAAHd3gAAzd3dwAAAAAAAAAAdwd4AAhwd3dwAAAAAAAAB3B48AAAB3d3dwAAAAAAAHcHjwAAAAAXd3eAAAAAAANweAAAAAAAF4d3fwAAAAAHN4BwAAAAADf3eHgAAAAANzcAcAAAAAAX8Hd3AAAAAHh4AXAAAAABl/AHd/AAAABzfwFwAAABEXeAB4fwAAAAcH8BcAAAAXdxEXeH8AAAAHB/AXAAAXePc3cXh/AAAABwfwBwAHePAAf3N3fwAAAAeHgAcAePAAAx8Bd38AAAAHcxAXBY8AAAMTF4B/AAAAB3ERNxeAAAAHM3eHgAAAAAB4N/8BeAAAB3cHN/AAAAAAd3N4ARdwAQdweHgAAAAAAAd3dzMREAB4N4N/AAAAAAAHd3d3cRF3c3g38AAAAAAAAHd3dzd3d3d3fwAAAAAAAAAHd3eId3hzd/AAAAAAAAAAAAh3dzd3d/8AAAAAAAAAAAAAD/+Ij/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////w////AB///AAH//gMA//wDgH/4B8A/+A/gH/A/4A/wH+AP8B/AD+AfAQfgHAAH4BAAB+AAAAfgADAH4ADwB+AB8AfwA/AP8AHAD/gAAB/4AAAf/AAAP/4AAH//AAD//8AB///wD////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791038455199,"unified_at":"2026-10-03T14:40:55.199Z","metadata":{"hashes":{"sha256":"9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b","sha1":"9bb88f703e234a89ff523514a5c676ac12ae6225","md5":"8f8ff6b696859c3afe7936c345b098bd","sha512":"7817186633c86f95409213994b458937cc56eae49265db3051d061c9ddda1421acccf38f70f6c92ff782936c75420713842a62de4f62cf17a6cd6fc1dc7d1164","ssdeep":"3072:KpDlT1fcjwpur6aIT2j1m53+3ZuzLiA9V+KUnOoJddibbJb/Fs+c6CUiAsC57Cex:TJmZdLi/nOkrcsU7CRLi/nOkrccU3C","ssdeep_chunks":["3072:KpDlT1f","3072:pDlT1fc","3072:DlT1fcj","3072:lT1fcjw","3072:T1fcjwp","3072:1fcjwpu","3072:fcjwpur","3072:cjwpur6","3072:jwpur6a","3072:wpur6aI","3072:pur6aIT","3072:ur6aIT2","3072:r6aIT2j","3072:6aIT2j1","3072:aIT2j1m","3072:IT2j1m5","3072:T2j1m53","3072:2j1m53+","3072:j1m53+3","3072:1m53+3Z","3072:m53+3Zu","3072:53+3Zuz","3072:3+3ZuzL","3072:+3ZuzLi","3072:3ZuzLiA","3072:ZuzLiA9","3072:uzLiA9V","3072:zLiA9V+","3072:LiA9V+K","3072:iA9V+KU","3072:A9V+KUn","3072:9V+KUnO","3072:V+KUnOo","3072:+KUnOoJ","3072:KUnOoJd","3072:UnOoJdd","3072:nOoJddi","3072:OoJddib","3072:oJddibb","3072:JddibbJ","3072:ddibbJb","3072:dibbJb/","3072:ibbJb/F","3072:bbJb/Fs","3072:bJb/Fs+","3072:Jb/Fs+c","3072:b/Fs+c6","3072:/Fs+c6C","3072:Fs+c6CU","3072:s+c6CUi","3072:+c6CUiA","3072:c6CUiAs","3072:6CUiAsC","3072:CUiAsC5","3072:UiAsC57","3072:iAsC57C","3072:AsC57Ce","3072:sC57Cex","6144:KpDlT1f","6144:pDlT1fc","6144:DlT1fcj","6144:lT1fcjw","6144:T1fcjwp","6144:1fcjwpu","6144:fcjwpur","6144:cjwpur6","6144:jwpur6a","6144:wpur6aI","6144:pur6aIT","6144:ur6aIT2","6144:r6aIT2j","6144:6aIT2j1","6144:aIT2j1m","6144:IT2j1m5","6144:T2j1m53","6144:2j1m53+","6144:j1m53+3","6144:1m53+3Z","6144:m53+3Zu","6144:53+3Zuz","6144:3+3ZuzL","6144:+3ZuzLi","6144:3ZuzLiA","6144:ZuzLiA9","6144:uzLiA9V","6144:zLiA9V+","6144:LiA9V+K","6144:iA9V+KU","6144:A9V+KUn","6144:9V+KUnO","6144:V+KUnOo","6144:+KUnOoJ","6144:KUnOoJd","6144:UnOoJdd","6144:nOoJddi","6144:OoJddib","6144:oJddibb","6144:JddibbJ","6144:ddibbJb","6144:dibbJb/","6144:ibbJb/F","6144:bbJb/Fs","6144:bJb/Fs+","6144:Jb/Fs+c","6144:b/Fs+c6","6144:/Fs+c6C","6144:Fs+c6CU","6144:s+c6CUi","6144:+c6CUiA","6144:c6CUiAs","6144:6CUiAsC","6144:CUiAsC5","6144:UiAsC57","6144:iAsC57C","6144:AsC57Ce","6144:sC57Cex","3072:TJmZdLi","3072:JmZdLi/","3072:mZdLi/n","3072:ZdLi/nO","3072:dLi/nOk","3072:Li/nOkr","3072:i/nOkrc","3072:/nOkrcs","3072:nOkrcsU","3072:OkrcsU7","3072:krcsU7C","3072:rcsU7CR","3072:csU7CRL","3072:sU7CRLi","3072:U7CRLi/","3072:7CRLi/n","3072:CRLi/nO","3072:RLi/nOk","3072:/nOkrcc","3072:nOkrccU","3072:OkrccU3","3072:krccU3C"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"TSP Dork generator hot edition.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":426496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1528650586000,"last_seen":1724649959000,"last_multi_scan":1724649959000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","autoit","autorun","banker","binder","bladabindi","delf","mofksys","neshta","njrat","rat"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":37},"sandbox_signatures":{"informative_count":73,"suspicious_count":14,"malicious_count":4,"total":91},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/grayware_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00015271-00002272-0000010C-5409048498\n \"\" queries volume information of \"C:\\TSP Dork generator hot edition.exe\" at 00015271-00002272-0000010C-5452966258","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"E:\\cracking\\Programs\\SQLi dumper and dorks\\TSP Dork generator hot edition\\TSP Dork generator hot edition\\obj\\Debug\\TSP Dork generator hot edition.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 67340000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A120000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 695C0000\n \"\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll\" at 66D50000\n \"\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll\" at 66840000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"TSP_Dork_generator_hot_edition.My\"\n Pattern match: \"https://dl.dropbox.com/s/mf700aojmh05jqx/version.txt?dl=0\"\n Pattern match: \"https://dl.dropbox.com/s/3y13fhzxmgyb69o/TSP%20Dork%20generator.rar?dl=0\"\n Pattern match: \"box.com/s/mf700aojmh05jqx/version.txt?dl=0\"\n Pattern match: \"opbox.com/s/3y13fhzxmgyb69o/TSP%20Dork%20generator.rar?dl=0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"TSP Dork generator hot edition.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"15.6.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/67 Antivirus vendors marked sample as malicious (2% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007180.00000000.66512.98790000.00000004.mdmp, 00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007180.00000000.66512.98790000.00000004.mdmp, 00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007180)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetWindowTextW\" with parameter \"Form1\" - (UID: 00000000-00007180)\n \"TSPDorkgeneratorhotedition.exe\" called \"GetWindowTextW\" (UID: 00000000-00007180)\n \"TSPDorkgeneratorhotedition.exe\" called \"GetWindowTextW\" with parameter \"Microsoft .NET Framework\" - (UID: 00000000-00007180)\n \"TSPDorkgeneratorhotedition.exe\" called \"GetWindowTextW\" with parameter \"&Details\" - (UID: 00000000-00007180)\n \"TSPDorkgeneratorhotedition.exe\" called \"GetWindowTextW\" with parameter \"Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to\" - (UID: 00000000-00007180)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetActiveWindow\" (UID: 00000000-00007180)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"TSPDorkgeneratorhotedition.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007180)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000072006f000000000000000000000000006500000000006600000000000000010000006f002000000036003400b0637b98ea01000000000000010000000100000039005c000000000000000000400000005c006d0010da7b98ea01000000000000140000000a0000006600690000000000 (UID: 00000000-00007180)\n \"TSPDorkgeneratorhotedition.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000db04daa4fa7f000000000000ea010000ec0000000000000000000000000000000000000000000000000000000000000000006f7efa7f0000000000000000000080c9dfa4fa7f0000000000000000000000006f7efa7f00000000000000000000e0586f7efa7f000008000000000000006b11767efa7f000000000000 (UID: 00000000-00007180)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007180)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007180)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"TSPDorkgeneratorhotedition.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"6725901194,1192,109,,GetWindowTextW,user32.dll,\"00:17:17.062\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007180.00000000.66512.B2B10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"TSPDorkgeneratorhotedition.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"TSPDorkgeneratorhotedition.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"TSP Dork generator hot edition.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CompareString\"; File: \"TSP Dork generator hot edition.exe\")\n Found reference to API (Indicator: \"GetObject\"; File: \"TSP Dork generator hot edition.exe\")\n Found reference to API (Indicator: \"MessageBox\"; File: \"TSP Dork generator hot edition.exe\")\n Found reference to API (Indicator: \"CompareString\"; Source: \"00000000-00007180.00000000.66512.965B2000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetObject\"; Source: \"00000000-00007180.00000000.66512.965B2000.00000002.mdmp\")\n Found reference to API (Indicator: \"MessageBox\"; Source: \"00000000-00007180.00000000.66512.965B2000.00000002.mdmp\")\n Found reference to API (Indicator: \"AddDllDirectory\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found reference to API (Indicator: \"DefWindowProcA\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"at System.Windows.Forms.Control.WmShowWindow(Message& m)\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found reference to API \"at System.Windows.Forms.Form.WmShowWindow(Message& m)\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found reference to API \"WmShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00007180.00000000.66512.98790000.00000004.mdmp\n \"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00007180.00000000.66512.98790000.00000004.mdmp\n \"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00007180.00000000.66512.9A250000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00007180.00000000.66512.9A250000.00000004.mdmp\n \"Software\\Microsoft\\.NETFramework\" in Source: 00000000-00007180.00000000.66512.9A250000.00000004.mdmp\n \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\" in Source: 00000000-00007180.00000000.66512.9A250000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7180:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7180:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7180:120:WilError_01\"\n \"Local\\SM0:7180:304:WilStaging_02\"\n \"SM0:7180:304:WilStaging_02\"\n \"SM0:7180:120:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"TSP Dork generator hot edition.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"TSPDorkgeneratorhotedition.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A1F50000\n \"TSPDorkgeneratorhotedition.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A0BD0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"TSPDorkgeneratorhotedition.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 7ABA0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"TSPDorkgeneratorhotedition.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A2ED0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c72fa1fa7f0000@ntdll.dll\"\n \"220023000000000018c72fa1fa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"TSP Dork generator hot edition.exe\" was detected as \".NET\" and name: \"Library\"\n \"TSP Dork generator hot edition.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"TSP Dork generator hot edition.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"TSPDorkgeneratorhotedition.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"TSP Dork generator hot edition.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"TSP Dork generator hot edition.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"TSP Dork generator hot edition.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"TSPDorkgeneratorhotedition.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"TSPDorkgeneratorhotedition.exe\" queries basic process information of the \"C:\\TSPDorkgeneratorhotedition.exe\" (UID: 7180)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\TSPDorkgeneratorhotedition.exe\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"TSPDorkgeneratorhotedition.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"GetResponse\" in \"TSP Dork generator hot edition.exe\"\n Observed Namespace \"System.Net.HttpWebResponse\" and MemberReference \"GetResponseStream\" in \"TSP Dork generator hot edition.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"TSP Dork generator hot edition.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"TSP Dork generator hot edition.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"TSP Dork generator hot edition.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007180.00000000.66512.98790000.00000004.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json01/05\" - Source: \"00000000-00007180.00000000.66512.989D0000.00000002.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,001/05\" - Source: \"00000000-00007180.00000000.66512.989D0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://dl.dropbox.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"TSPDorkgeneratorhotedition.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1644235043\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"TSPDorkgeneratorhotedition.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"771819351\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"TSPDorkgeneratorhotedition.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetComputerNameW\" (UID: 00000000-00007180)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00007180.00000000.66512.9A250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"TSPDorkgeneratorhotedition.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007180.00000000.66512.98790000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007180.00000000.66512.98790000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\TSPDorkgeneratorhotedition.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007180.00000000.66512.98790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"TSPDorkgeneratorhotedition.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"TSPDorkgeneratorhotedition.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"TSPDorkgeneratorhotedition.exe\" queried SystemProcessInformation at 00000000-00007180-00000C13-32563320 [PID: 7180]\n \"TSPDorkgeneratorhotedition.exe\" queried SystemProcessInformation at 00000000-00007180-00000C13-32564674 [PID: 7180]\n \"TSPDorkgeneratorhotedition.exe\" queried SystemProcessInformation at 00000000-00007180-00000C13-33824898 [PID: 7180]\n \"TSPDorkgeneratorhotedition.exe\" queried SystemProcessInformation at 00000000-00007180-00000C13-33826277 [PID: 7180]\n \"TSPDorkgeneratorhotedition.exe\" queried SystemProcessInformation at 00000000-00007180-00000C13-34048952 [PID: 7180]\n \"TSPDorkgeneratorhotedition.exe\" queried SystemProcessInformation at 00000000-00007180-00000C13-34050577 [PID: 7180]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"TSPDorkgeneratorhotedition.exe queries ProcessDebugPort (UID: 7180)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"odoni MT Poster Compressed\" is a hint for the obfuscator \"MPRESS\"\n \"BODONI MT POSTER COMPRESSED\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"TSPDorkgeneratorhotedition.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"f0f78198ea010000\"\n \"szProvider\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\"\n \"dwProvType\": \"24\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"TSP Dork generator hot edition.exe\" has resource with unusual entropy \"RT_ICON:7.97804242764\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"TSPDorkgeneratorhotedition.exe\" reads file \"C:\\Windows\\win.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$37","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"TSPDorkgeneratorhotedition.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"TSPDorkgeneratorhotedition.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"TSPDorkgeneratorhotedition.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"TSPDorkgeneratorhotedition.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"TSPDorkgeneratorhotedition.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/68 Antivirus vendors marked sample as malicious (48% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00010895-00003876-00000033-26637532124","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":86,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":414,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","autoit","autorun","banker","binder","bladabindi","delf","mofksys","neshta","njrat","rat"],"sample_flags":["Multi-Process","Sample Crashed"],"sandbox_reports":[{"id":"659795c1a49fcdb8450e1335","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Hacktool.KP","submit_name":"TSP Dork generator hot edition.exe","analysis_start_time":"2024-01-05T05:38:10+00:00","indicators_count":{"informative":73,"suspicious":13,"malicious":3},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true},{"id":"5b3780227ca3e1232832e14a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":44,"malware_family":"ML.Attribute","submit_name":"TSP Dork generator hot edition.exe","analysis_start_time":"2018-07-04T04:56:01+00:00","indicators_count":{"informative":9,"suspicious":7,"malicious":2},"is_in_unified_schema":true},{"id":"5b1d5b5a7ca3e139730e1d75","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":36,"malware_family":"ML.Attribute","submit_name":"TSP Dork generator hot edition.exe","analysis_start_time":"2018-06-10T18:07:28+00:00","indicators_count":{"informative":9,"suspicious":5,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}],"processes":[{"pid":7180,"ppid":0,"name":"TSPDorkgeneratorhotedition.exe","command_line":"","sha256":"9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b","normalized_path":"C:\\TSPDorkgeneratorhotedition.exe","uid":"00000000-00007180","icon":"$38"},{"pid":7764,"ppid":7180,"name":"WerFault.exe","command_line":"-u -p 7180 -s 1348","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007180","uid":"00000000-00007764"},{"pid":7696,"ppid":7180,"name":"WerFault.exe","command_line":"-u -p 7180 -s 1348","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007180","uid":"00000000-00007696"},{"pid":7684,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 7180 -ip 7180","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007684","icon":"$39"}],"all_imported_dlls":["oleaut32.dll","System.Xml.ni.dll","System.Drawing.dll","KernelBase.dll","shlwapi.dll","ole32.dll","System.Core.ni.dll","System.Windows.Forms.dll","mscorrc.dll","version.dll","System.dll","kernel32.dll","advapi32.dll","rpcrt4.dll","msctf.dll","uxtheme.dll","Microsoft.VisualBasic.ni.dll","clbcatq.dll","mscoree.dll","usp10.dll","msvcr120_clr0400.dll","mscorlib.ni.dll","clrjit.dll","System.Windows.Forms.ni.dll","dwmapi.dll","diasymreader.dll","user32.dll","rpcss.dll","nlssorting.dll","System.Runtime.Remoting.ni.dll","System.Runtime.Remoting.dll","shell32.dll","ntdll.dll","clr.dll","System.Drawing.ni.dll","comctl32.dll","WindowsCodecs.dll","System.Core.dll","msvcrt.dll","sechost.dll","gdi32.dll","lpk.dll","mscorlib.dll","cryptbase.dll","GdiPlus.dll","riched20.dll","mscoreei.dll","imm32.dll","System.ni.dll","msvcp_win.dll","cryptsp.dll","rsaenh.dll","fltLib.dll","DataExchange.dll","VxSSL64.dll","win32u.dll","SHCore.dll","powrprof.dll","apphelp.dll","bcryptprimitives.dll","CoreMessaging.dll","profapi.dll","gdi32full.dll","cfgmgr32.dll","TextInputFramework.dll","System.Configuration.ni.dll","dcomp.dll","DWrite.dll","WinTypes.dll","twinapi.appcore.dll","ws2_32.dll","ucrtbase.dll","CoreUIComponents.dll","d3d11.dll","dxgi.dll","ucrtbase_clr0400.dll","vcruntime140_clr0400.dll","psapi.dll","combase.dll","kernel.appcore.dll","windows.storage.dll","msls31.dll","bcrypt.dll","ntmarta.dll","rmclient.dll","api-ms-win-core-xstate-l2-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"C:\\TSP Dork generator hot edition.exe.config","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"C:\\TSP Dork generator hot edition.exe","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\b8de0f79bc74f6c423e1c719ee7afefd\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\3429c09afbdb2100c619fdeda717963d\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\marlett.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\batang.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cour.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\couri.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\courbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\courbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\daunpenh.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\dokchamp.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\estre.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\euphemia.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\gautami.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\gautamib.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Vani.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Vanib.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\gulim.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\impact.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\iskpota.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\iskpotab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kalinga.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kalingab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kartika.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kartikab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\KhmerUI.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\KhmerUIb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LaoUI.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LaoUIb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\latha.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\lathab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\lucon.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\malgunbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\mangal.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\mangalb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\meiryo.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\meiryob.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\himalaya.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\msjhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\msyhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\mingliu.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\mingliub.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\monbaiti.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\msgothic.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\msmincho.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\mvboli.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ntailu.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ntailub.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\nyala.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\phagspa.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\phagspab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\plantc.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\raavi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\raavib.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\segoesc.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\segoescb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\shruti.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\shrutib.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\simsunb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\sylfaen.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\taile.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\taileb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\tunga.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\tungab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\vrinda.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\vrindab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Shonar.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Shonarb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\msyi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\tahomabd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\angsa.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\angsai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\angsab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\angsaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\aparaj.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\aparajb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\aparajbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\aparaji.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cordia.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cordiai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cordiab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cordiaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ebrima.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ebrimabd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\gisha.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\gishabd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kokila.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kokilab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kokilabi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kokilai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\leelawad.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\leelawdb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\msuighur.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\moolbor.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\symbol.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\utsaah.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\utsaahb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\utsaahbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\utsaahi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\vijaya.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\vijayab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\wingding.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\modern.fon","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\roman.fon","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\script.fon","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\andlso.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\arabtype.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\simpo.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\simpbdo.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\simpfxo.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\majalla.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\majallab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\trado.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\tradbdo.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ahronbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\david.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\davidbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\frank.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\lvnm.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\lvnmbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\mriam.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\mriamc.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\nrkis.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\rod.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\simfang.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\simhei.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\simkai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\angsau.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\angsaui.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\angsaub.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\angsauz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\browa.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\browai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\browab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\browaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\browau.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\browaui.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\browaub.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\browauz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cordiau.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cordiaub.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cordiauz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cordiaui.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcdl.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcdi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcdb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcdbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcel.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcei.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upceb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcebi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcfl.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcfi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcfb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcfbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcil.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcii.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcib.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcibi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcjl.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcji.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcjb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcjbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upckl.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcki.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upckb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upckbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcll.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upcli.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upclb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\upclbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\kaiu.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\l_10646.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\calibri.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\calibrii.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\calibrib.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\calibriz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cambria.ttc","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cambriai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cambriab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\cambriaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Candara.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Candarai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Candarab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Candaraz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\comic.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\comicbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\consola.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\consolai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\consolab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\consolaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\constan.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\constani.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\constanb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\constanz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\corbel.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\corbeli.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\corbelb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\corbelz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\framd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\framdit.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\Gabriola.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\georgia.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\georgiai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\georgiab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\georgiaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\pala.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\palai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\palab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\palabi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\segoepr.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\segoeprb.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\trebuc.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\trebucit.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\trebucbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\trebucbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\verdanai.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\verdanab.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\verdanaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\webdings.ttf","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\coure.fon","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\serife.fon","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\sserife.fon","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\smalle.fon","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\smallf.fon","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Fonts\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"C:\\Settings\\language.txt","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\symbols\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\symbols\\dll\\Microsoft.VisualBasic.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\dll\\Microsoft.VisualBasic.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.VisualBasic.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"C:\\TSP Dork generator hot edition.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\symbols\\exe\\TSP Dork generator hot edition.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\exe\\TSP Dork generator hot edition.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\TSP Dork generator hot edition.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\symbols\\dll\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\dll\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"C:\\presets\\searchfunctions\\preset1.txt","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"C:\\9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b.exe.config","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"C:\\9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b.exe","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\92c67571960b3d7f3fd30bf9d4a9bc24\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\47e0be927382f169f5de470fab0ceb7d\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\f5db2f7c181e6f1344c9bc8dbcffce3b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\43d86904e41b891e07c2ce8a20996e2c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\617299d2bd5dcfe094cedface0c39d1c\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\38470d5ed01fd95e48dcf4e1b0b4774e\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\8089ab42d28c269586b8d72c8e01701c\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9f55378d72425b996754ea45a6c99946\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll","sources":[{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5b1d5b5a7ca3e139730e1d75"},{"report_type":"sandbox","report_id":"5b3780227ca3e1232832e14a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7180:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"name":"Local\\SM0:7180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"name":"SM0:7180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]},{"name":"SM0:7180:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"659795c1a49fcdb8450e1335"}]}]}},"report_ids":{"sandbox_job_ids":["659795c1a49fcdb8450e1335","5b3780227ca3e1232832e14a","5b1d5b5a7ca3e139730e1d75"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/grayware_confidence_100% Sample 9cd46027d63c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9cd46027d63c…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_100% Sample 9cd46027d63c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9cd46027d63c…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9cd46027d63c36e53f4347d43554336c2ea050d38be3ff9a608cb94cca6ab74b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_100% Sample 9cd46027d63c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9cd46027d63c…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]]