24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 81:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample a1bfe37c9b7a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a1bfe37c9b7a…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 22 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":22,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T780,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177464" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177472" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177500" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177712" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177528" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177684" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177696" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "4717852" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177580" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177676" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "4717848" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177544" - (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "FindResourceA" with parameter "13177552" - (UID: 00000000-00000380)26:Tcc8,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224064'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223920'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224080'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223968'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223936'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223984'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224032'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223904'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224016'}" (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224048'}" (UID: 00000000-00000380) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427584'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427440'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427600'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427488'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427456'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427504'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427552'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427424'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427536'}" (UID: 00000000-00007544) "yd0NM48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427568'}" (UID: 00000000-00007544) "qg0Ur94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716736'}" (UID: 00000000-00004412) "qg0Ur94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716592'}" (UID: 00000000-00004412) "qg0Ur94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716752'}" (UID: 00000000-00004412)27:T6cc,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00000380) "yd0NM48.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007544) "yd0NM48.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007544) "qg0Ur94.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004412) "qg0Ur94.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004412) "qg0Ur94.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004412) "GC6KR66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006152) "GC6KR66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006152) "GC6KR66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00006152) "GC6KR66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00006152) "GC6KR66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00006152) "yM1yn26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004916) "yM1yn26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004916) "yM1yn26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004916) "yM1yn26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00004916) "yM1yn26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00004916) "yM1yn26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP\ (UID: 00000000-00004916)28:T958,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")29:T482,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")2a:T8e6,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")2b:Te68,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")2c:T2627,file/memory contains long string with (Indicator: "SHA384"; File: "1Mj28pv0.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp")2d:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-15-00C91F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-15-00C91F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-16-00C944B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-16-00C944B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-22-00C9681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-22-00C9681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-26-00C924E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-26-00C924E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-29-00C952B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-29-00C952B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000380-46439-31-00C92390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000380-46439-31-00C92390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-33-00C92F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-33-00C92F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000380-46439-36-00C93BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000380-46439-36-00C93BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-37-00C93FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-37-00C93FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-40-00C92267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-40-00C92267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-41-00C96495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-41-00C96495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-42-00C9202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00000380-46439-42-00C9202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-42-00C9202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-43-00C91AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-43-00C91AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-44-00C92AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-44-00C92AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-52-00C94EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-52-00C94EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-57-00C96298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-57-00C96298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-59-00C9621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-59-00C9621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-60-00C9597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-60-00C9597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-62-00C955A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-62-00C955A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-63-00C95467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-63-00C95467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-65-00C953A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-65-00C953A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-66-00C92630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-66-00C92630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-71-00C92CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-71-00C92CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-72-00C918A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-72-00C918A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000380-46439-73-00C917EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000380-46439-73-00C917EE2e:T536,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2f:T8ca,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "yM1yn26.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "6Bt6uh0.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")30:T25a2,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000380) "yd0NM48.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007544) "yd0NM48.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007544) "yd0NM48.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007544) "qg0Ur94.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004412) "qg0Ur94.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004412) "qg0Ur94.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004412) "GC6KR66.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006152) "GC6KR66.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006152) "GC6KR66.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006152) "yM1yn26.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004916) "yM1yn26.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004916) "yM1yn26.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004916)31:Ta7a,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fb4700fcdfe972289f650000000000d0fb4700baa8e972289f650028fc4700c58be972289f650001000000a807c1d20000000098a47a6f0000000003000000dcfc47000a0000000c07000020fd470058fc47005d00000003000000e0fb4700e8fb4700f0fe4700d0bbe972006b6da0feffffff30fd47005511e87298a47a6f (UID: 00000000-00000380) "yd0NM48.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f96300fcdfe972f08791020000000080f96300baa8e972f0879102d8f96300c58be972f087910201000000974fb28d00000000e856644c00000000030000008cfa63000a000000100f0000d0fa630008fa63005d0000000300000090f9630098f96300a0fc6300d0bbe972cf263afffeffffffe0fa63005511e872e856644c (UID: 00000000-00007544) "qg0Ur94.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f7db00fcdfe972e0982a030000000068f7db00baa8e972e0982a03c0f7db00c58be972e0982a0301000000fdbc82ca0000000076d8df3c000000000300000074f8db000a00000094180000b8f8db00f0f7db005d0000000300000078f7db0080f7db0088fadb00d0bbe972bddbb2b8feffffffc8f8db005511e87276d8df3c (UID: 00000000-00004412) "GC6KR66.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000dfe972208be80000000000a0f7b100baa8e972208be800f8f7b100c58be972208be80001000000dbed489900000000cc877e380000000003000000acf8b1000a000000141d0000f0f8b10028f8b1005d00000003000000b0f7b100b8f7b100c4fab100d0bbe972a38a12ebfeffffff04f9b1005511e872cc877e3800000000 (UID: 00000000-00006152) "yM1yn26.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f9f600fcdfe972f0873e030000000038f9f600baa8e972f0873e0390f9f600c58be972f0873e03010000009961dcc900000000deba894f000000000300000044faf6000a000000ec1e000088faf600c0f9f6005b0000000300000048f9f60050f9f60058fcf600d0bbe9728908c1bbfeffffff98faf6005511e872deba894f (UID: 00000000-00004916) "1Mj28pv0.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00004544) "4jh628Nr.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000002e00002e2493000090382903700c270390fa28030000000000000000000000000000000000000000bcf4df00142c290300000000000074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d00 (UID: 00000000-00000336)32:T735,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "yd0NM48.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yd0NM48.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "qg0Ur94.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "qg0Ur94.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "GC6KR66.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GC6KR66.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "yM1yn26.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yM1yn26.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Mj28pv0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2sh2882.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Xu86HZ.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Xu86HZ.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")33:T4b7,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")34:Ta27,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "2486342454,1804,3024,,RtlGetVersion,NTDLL.dll,"00:28:14.453",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "1738524124,6292,3024,,RtlGetVersion,NTDLL.dll,"00:28:16.031",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp") Found reference to API "41428528836,6292,3024,,RtlGetVersion,NTDLL.dll,"00:28:32.562",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")35:T924,"1Mj28pv0.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1Mj28pv0.exe" at 00000000-00004544-00000C16-706195724 "4jh628Nr.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4jh628Nr.exe" at 00000000-00000336-00000C16-721252327 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00000336-00000C16-721507413 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00000336-00000C16-721736210 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00000336-00000C16-722628986 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00000336-00000C16-723718035 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll" at 00000000-00000336-00000C16-723867913 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00000000-00000336-00000C16-723927084 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00000336-00000C16-724337567 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000336-00000C16-724951213 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000336-00000C16-724969722 "4jh628Nr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000336-00000C16-72497017036:T4147,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000380) "yd0NM48.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007544) "yd0NM48.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007544) "yd0NM48.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007544) "yd0NM48.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007544) "yd0NM48.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007544) "yd0NM48.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007544) "yd0NM48.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007544) "qg0Ur94.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004412) "qg0Ur94.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004412) "qg0Ur94.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004412) "qg0Ur94.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004412) "qg0Ur94.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004412) "qg0Ur94.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004412) "qg0Ur94.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004412) "GC6KR66.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006152) "GC6KR66.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006152) "GC6KR66.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006152) "GC6KR66.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006152) "GC6KR66.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006152) "GC6KR66.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006152) "GC6KR66.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006152) "yM1yn26.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004916) "yM1yn26.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004916) "yM1yn26.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004916) "yM1yn26.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004916) "yM1yn26.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004916) "yM1yn26.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004916) "yM1yn26.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004916) "1Mj28pv0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004544) "2sh2882.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007080) "2sh2882.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007080) "2sh2882.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007080) "2sh2882.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007080) "2sh2882.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007080) "2sh2882.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007080) "3Xu86HZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006512) "3Xu86HZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006512) "3Xu86HZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006512) "3Xu86HZ.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006512) "3Xu86HZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006512) "3Xu86HZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006512) "3Xu86HZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006512) "3Xu86HZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006512) "3Xu86HZ.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006512) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000336) "4jh628Nr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00000336)37:T125a8,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00000380) "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000380) "yd0NM48.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007544) "yd0NM48.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007544) "qg0Ur94.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004412) "qg0Ur94.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004412) "GC6KR66.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00006152) "GC6KR66.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006152) "yM1yn26.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004916) "yM1yn26.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004916) "1Mj28pv0.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004544) "1Mj28pv0.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004544) "2sh2882.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007080) "2sh2882.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007080) "3Xu86HZ.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006512) "3Xu86HZ.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006512) "4jh628Nr.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00000336) "4jh628Nr.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000336)38:T199b,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000000.109924.03640000.00000004.mdmp, 00000000-00000336.00000000.109924.0A170000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03640000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000001.110609.00890000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "32.DLL" FUNCTION="CreateProcessW"/>" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp 00000000-00000380.00000002.112529.00630000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp 00000000-00000380.00000002.112529.00630000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp 00000000-00000380.00000002.112529.00630000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp 00000000-00000380.00000002.112529.00630000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp 00000000-00000380.00000002.112529.00630000.00000004.mdmp"), Found reference to API "PRINT NS_ElevateCreateProcess::APIHook_CreateProcessA 318 [ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp 00000000-00000380.00000002.112529.00630000.00000004.mdmp"), Found reference to API "2487497138 1804 3140 CreateProcessA kernel32.dll "00:28:14.453" RX=0 PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp 00000000-00000380.00000002.112529.00630000.00000004.mdmp"), Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp"), Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp 00000000-00004412.00000001.110738.03280000.00000004.mdmp 00000000-00004412.00000002.112657.03250000.00000004.mdmp 00000000-00004412.00000002.112657.03280000.00000004.mdmp"), Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp 00000000-00004412.00000001.110738.03280000.00000004.mdmp 00000000-00004412.00000002.112657.03280000.00000004.mdmp"), Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp 00000000-00004412.00000001.110738.03280000.00000004.mdmp 00000000-00004412.00000002.112657.03280000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp 00000000-00004412.00000001.110738.03280000.00000004.mdmp 00000000-00004412.00000002.112657.03280000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp 00000000-00004412.00000001.110738.03280000.00000004.mdmp 00000000-00004412.00000002.112657.03280000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp 00000000-00004412.00000001.110738.03280000.00000004.mdmp 00000000-00004412.00000002.112657.03280000.00000004.mdmp")39:Te86,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")3a:T96c,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")3b:T12d4d,Found reference to API (Indicator: "RegCloseKey"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EqualSid"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FreeSid"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FindResourceA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateMutexA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LocalFree"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FormatMessageA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "lstrcmpA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetVersion"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DeleteFileA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FreeLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetVersionExA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetProcAddress"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FindNextFileA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetTempPathA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "TerminateProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetLastError"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateThread"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetFilePointer"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GlobalFree"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ExitProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "WriteFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "TerminateThread"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FreeResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateEventA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LoadResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "Sleep"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LockResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ReadFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GlobalLock"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SizeofResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetEvent"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetFileTime"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LocalAlloc"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FindClose"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateProcessA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CloseHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateFileA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "MulDiv"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CompareStringA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ResetEvent"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetTickCount"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "MessageBoxA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CharNextA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ShowWindow"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CharPrevA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CharUpperA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetWindowRect"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "MessageBeep"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LoadStringA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SendMessageA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ReleaseDC"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetDC"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetWindowPos"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EnableWindow"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "PeekMessageA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DecryptFileA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetACP"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HeapAlloc"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "TlsAlloc"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CompareStringW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCPInfo"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateFileW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RaiseException"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RtlUnwind"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetOEMCP"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "TlsSetValue"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FindNextFileW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HeapFree"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetStdHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "TlsFree"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HeapSize"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LCMapStringW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetFileType"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "IsValidLocale"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DecodePointer"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "TlsGetValue"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EncodePointer"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetStdHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FreeConsole"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetLastError"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LookupAccountNameA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetUserNameA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetThreadContext"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CopyFileA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetVersionExW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "VirtualFree"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetThreadContext"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetComputerNameExW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateEventW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DeleteFileW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ResumeThread"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InternetReadFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InternetOpenUrlA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InternetOpenW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HttpOpenRequestA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InternetConnectA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HttpSendRequestA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InternetOpenA"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetStockObject"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EnumResourceTypesW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetTempPathW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "UnregisterWait"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "FindResourceW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HeapCreate"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "HeapDestroy"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CoInitialize"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "PathRenameExtensionW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "PathAddBackslashW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "PathRemoveBackslashW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LoadIconW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "MessageBoxW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "EnumWindows"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "SetFocus"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DestroyWindow"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "TranslateMessage"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CharUpperW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CharLowerW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "LoadCursorW"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItem"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "LoadCursor"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp, 00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "InsertMenu"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowEx"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "PathCombineW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "PathAppendW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000380.00000002.112529.00C91000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000380.00000002.112529.00C91000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000380.00000002.112529.00C91000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000380.00000002.112529.00C91000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004412.00000001.110738.00B21000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004412.00000001.110738.00B21000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004412.00000001.110738.00B21000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004412.00000001.110738.00B21000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")3c:T438,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp")3d:T8ba,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")3e:Tc7e,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp")3f:T14ca,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe "System\CurrentControlSet\Control\Session Manager" in Source: 45797-17-0040256D "08055da9Software\Mic" in Source: 00000000-00000336.00000000.109924.03260000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00000336.00000000.109924.03260000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "SOFTWARE\WOW6432Node\Clients\StartMenuInternet" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00000336.00000000.109924.05510000.00000004.mdmp 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32" in Source: 00000000-00000336.00000001.111846.03260000.00000004.mdmp 00000000-00000336.00000002.113765.03260000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00000336.00000001.111846.05510000.00000004.mdmp 00000000-00000336.00000002.113765.05510000.00000004.mdmp "Read7HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00000336.00000001.111846.0A200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000380.00000002.112529.00C91000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004412.00000001.110738.00B21000.00000020.mdmp40:T8e4,"1Mj28pv0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "1Mj28pv0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "1Mj28pv0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "1Mj28pv0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "4jh628Nr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135]41:T74e,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "yd0NM48.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "qg0Ur94.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GC6KR66.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "yM1yn26.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "3Xu86HZ.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4jh628Nr.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5hi9dC7.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2sh2882.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1Mj28pv0.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE42:T627,Observed unmanaged function "DwmIsCompositionEnabled" in "4jh628Nr.exe" Observed unmanaged function "BitBlt" in "4jh628Nr.exe" Observed unmanaged function "CreateRoundRectRgn" in "4jh628Nr.exe" Observed unmanaged function "PathCompactPath" in "4jh628Nr.exe" Observed unmanaged function "ClientToScreen" in "4jh628Nr.exe" Observed unmanaged function "CreateWindowEx" in "4jh628Nr.exe" Observed unmanaged function "DestroyWindow" in "4jh628Nr.exe" Observed unmanaged function "DrawMenuBar" in "4jh628Nr.exe" Observed unmanaged function "FindWindow" in "4jh628Nr.exe" Observed unmanaged function "GetClassName" in "4jh628Nr.exe" Observed unmanaged function "GetClientRect" in "4jh628Nr.exe" Observed unmanaged function "GetCursorPos" in "4jh628Nr.exe" Observed unmanaged function "GetDCEx" in "4jh628Nr.exe" Observed unmanaged function "GetMonitorInfo" in "4jh628Nr.exe" Observed unmanaged function "GetScrollInfo" in "4jh628Nr.exe" Observed unmanaged function "GetSystemMenu" in "4jh628Nr.exe" Observed unmanaged function "GetWindowDC" in "4jh628Nr.exe" Observed unmanaged function "GetWindowLong" in "4jh628Nr.exe" Observed unmanaged function "GetWindowRect" in "4jh628Nr.exe" Observed unmanaged function "GetWindowText" in "4jh628Nr.exe" Observed unmanaged function "InsertMenu" in "4jh628Nr.exe" Observed unmanaged function "InsertMenuItem" in "4jh628Nr.exe" Observed unmanaged function "MonitorFromWindow" in "4jh628Nr.exe" Observed unmanaged function "RegisterHotKey" in "4jh628Nr.exe" Observed unmanaged function "ReleaseCapture" in "4jh628Nr.exe"43:T392e,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "KERNEL32" at base 74de0000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "KERNEL32.DLL" at base 74de0000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74b80000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "FECLIENT.DLL" at base 72d60000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d30000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "NTDLL.DLL" at base 77580000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "yd0NM48.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "yd0NM48.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "yd0NM48.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "yd0NM48.exe" loaded module "KERNEL32" at base 74de0000 "yd0NM48.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "yd0NM48.exe" loaded module "KERNEL32.DLL" at base 74de0000 "yd0NM48.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74b80000 "yd0NM48.exe" loaded module "FECLIENT.DLL" at base 72d60000 "yd0NM48.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d30000 "yd0NM48.exe" loaded module "NTDLL.DLL" at base 77580000 "yd0NM48.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "qg0Ur94.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "qg0Ur94.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "qg0Ur94.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "qg0Ur94.exe" loaded module "KERNEL32" at base 74de0000 "qg0Ur94.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "qg0Ur94.exe" loaded module "KERNEL32.DLL" at base 74de0000 "qg0Ur94.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74b80000 "qg0Ur94.exe" loaded module "FECLIENT.DLL" at base 72d60000 "qg0Ur94.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d30000 "qg0Ur94.exe" loaded module "NTDLL.DLL" at base 77580000 "qg0Ur94.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "GC6KR66.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "GC6KR66.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "GC6KR66.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "GC6KR66.exe" loaded module "KERNEL32" at base 74de0000 "GC6KR66.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "GC6KR66.exe" loaded module "KERNEL32.DLL" at base 74de0000 "GC6KR66.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74b80000 "GC6KR66.exe" loaded module "FECLIENT.DLL" at base 72d60000 "GC6KR66.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d30000 "GC6KR66.exe" loaded module "NTDLL.DLL" at base 77580000 "GC6KR66.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "yM1yn26.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "yM1yn26.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "yM1yn26.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "yM1yn26.exe" loaded module "KERNEL32" at base 74de0000 "yM1yn26.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "yM1yn26.exe" loaded module "KERNEL32.DLL" at base 74de0000 "yM1yn26.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74b80000 "yM1yn26.exe" loaded module "FECLIENT.DLL" at base 72d60000 "yM1yn26.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d30000 "yM1yn26.exe" loaded module "NTDLL.DLL" at base 77580000 "yM1yn26.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "1Mj28pv0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "1Mj28pv0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "1Mj28pv0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "1Mj28pv0.exe" loaded module "KERNEL32" at base 74de0000 "1Mj28pv0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "1Mj28pv0.exe" loaded module "ADVAPI32.DLL" at base 74b80000 "1Mj28pv0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72c70000 "1Mj28pv0.exe" loaded module "SHLWAPI.DLL" at base 73f30000 "1Mj28pv0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74560000 "1Mj28pv0.exe" loaded module "VERSION.DLL" at base 73bd0000 "1Mj28pv0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 724c0000 "1Mj28pv0.exe" loaded module "USER32.DLL" at base 769f0000 "1Mj28pv0.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74360000 "1Mj28pv0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1Mj28pv0.exe" loaded module "MSCOREE.DLL" at base 72d00000 "1Mj28pv0.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 767a0000 "1Mj28pv0.exe" loaded module "PSAPI.DLL" at base 73f20000 "1Mj28pv0.exe" loaded module "RPCRT4.DLL" at base 766e0000 "1Mj28pv0.exe" loaded module "KERNEL32.DLL" at base 74de0000 "1Mj28pv0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70220000 "1Mj28pv0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1Mj28pv0.exe" loaded module "OLE32.DLL" at base 74c20000 "1Mj28pv0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "1Mj28pv0.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 767a0000 "1Mj28pv0.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74360000 "1Mj28pv0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72360000 "1Mj28pv0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f7c0000 "1Mj28pv0.exe" loaded module "SSPICLI.DLL" at base 73eb0000 "1Mj28pv0.exe" loaded module "ADVAPI32" at base 74b80000 "1Mj28pv0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "1Mj28pv0.exe" loaded module "NTDLL.DLL" at base 77580000 "2sh2882.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "2sh2882.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "2sh2882.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "2sh2882.exe" loaded module "KERNEL32" at base 74de0000 "2sh2882.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "2sh2882.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74360000 "2sh2882.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74560000 "3Xu86HZ.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "3Xu86HZ.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "3Xu86HZ.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "3Xu86HZ.exe" loaded module "KERNEL32" at base 74de0000 "3Xu86HZ.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "3Xu86HZ.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74360000 "3Xu86HZ.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74360000 "3Xu86HZ.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74360000 "3Xu86HZ.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74360000 "3Xu86HZ.exe" loaded module "NTDLL.DLL" at base 77580000 "3Xu86HZ.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "3Xu86HZ.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74560000 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74360000 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74360000 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74360000 "4jh628Nr.exe" loaded module "KERNEL32" at base 74de0000 "4jh628Nr.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "4jh628Nr.exe" loaded module "ADVAPI32.DLL" at base 74b80000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72c70000 "4jh628Nr.exe" loaded module "SHLWAPI.DLL" at base 73f30000 "4jh628Nr.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74560000 "4jh628Nr.exe" loaded module "VERSION.DLL" at base 73bd0000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 724c0000 "4jh628Nr.exe" loaded module "USER32.DLL" at base 769f0000 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74360000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "4jh628Nr.exe" loaded module "MSCOREE.DLL" at base 72d00000 "4jh628Nr.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 767a0000 "4jh628Nr.exe" loaded module "PSAPI.DLL" at base 73f20000 "4jh628Nr.exe" loaded module "RPCRT4.DLL" at base 766e0000 "4jh628Nr.exe" loaded module "KERNEL32.DLL" at base 74de0000 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70220000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "4jh628Nr.exe" loaded module "OLE32.DLL" at base 74c20000 "4jh628Nr.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73960000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 767a0000 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74360000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72360000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f7c0000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "4jh628Nr.exe" loaded module "UXTHEME.DLL" at base 73960000 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 71b40000 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f6b0000 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6ef30000 "4jh628Nr.exe" loaded module "NTDLL.DLL" at base 77580000 "4jh628Nr.exe" loaded module "SHELL32.DLL" at base 74ec0000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "4jh628Nr.exe" loaded module "BCRYPT.DLL" at base 73230000 "4jh628Nr.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71b10000 "4jh628Nr.exe" loaded module "IMM32.DLL" at base 77410000 "4jh628Nr.exe" loaded module "COMCTL32.DLL" at base 6eea0000 "4jh628Nr.exe" loaded module "GDI32.DLL" at base 74290000 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 6ea80000 "4jh628Nr.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76360000 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 6de40000 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 6ca50000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "4jh628Nr.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 723f0000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "4jh628Nr.exe" loaded module "DWRITE.DLL" at base 6c7d0000 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74360000 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74360000 "4jh628Nr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74360000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 6c640000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6c550000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "4jh628Nr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 6c270000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6c220000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "4jh628Nr.exe" loaded module "WS2_32.DLL" at base 76bc0000 "4jh628Nr.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73160000 "4jh628Nr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6c11000044:T67c,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "yd0NM48.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "yd0NM48.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "qg0Ur94.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "qg0Ur94.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "GC6KR66.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "GC6KR66.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "yM1yn26.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "yM1yn26.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "1Mj28pv0.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "1Mj28pv0.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "2sh2882.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "2sh2882.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "3Xu86HZ.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "3Xu86HZ.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73230000 "4jh628Nr.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76360000 "4jh628Nr.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 7323000045:T1137,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" was detected as "Microsoft Cabinet" and name: "sfx" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" was detected as "Microsoft Linker" and name: "Linker" "yd0NM48.exe" was detected as "Microsoft Cabinet" and name: "sfx" "yd0NM48.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "yd0NM48.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "yd0NM48.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "yd0NM48.exe" was detected as "Microsoft Linker" and name: "Linker" "qg0Ur94.exe" was detected as "Microsoft Cabinet" and name: "sfx" "qg0Ur94.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "qg0Ur94.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qg0Ur94.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "qg0Ur94.exe" was detected as "Microsoft Linker" and name: "Linker" "GC6KR66.exe" was detected as "Microsoft Cabinet" and name: "sfx" "GC6KR66.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GC6KR66.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GC6KR66.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "GC6KR66.exe" was detected as "Microsoft Linker" and name: "Linker" "yM1yn26.exe" was detected as "Microsoft Cabinet" and name: "sfx" "yM1yn26.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "yM1yn26.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "yM1yn26.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "yM1yn26.exe" was detected as "Microsoft Linker" and name: "Linker" "3Xu86HZ.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Xu86HZ.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Xu86HZ.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Xu86HZ.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Xu86HZ.exe" was detected as "Microsoft Linker" and name: "Linker" "4jh628Nr.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4jh628Nr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4jh628Nr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4jh628Nr.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4jh628Nr.exe" was detected as "Microsoft Linker" and name: "Linker" "5hi9dC7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5hi9dC7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5hi9dC7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5hi9dC7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5hi9dC7.exe" was detected as "Microsoft Linker" and name: "Linker" "2sh2882.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2sh2882.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2sh2882.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2sh2882.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2sh2882.exe" was detected as "Microsoft Linker" and name: "Linker" "6Bt6uh0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6Bt6uh0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6Bt6uh0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6Bt6uh0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6Bt6uh0.exe" was detected as "Microsoft Linker" and name: "Linker" "1Mj28pv0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Mj28pv0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Mj28pv0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Mj28pv0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Mj28pv0.exe" was detected as "Microsoft Linker" and name: "Linker"46:T1d27,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "yd0NM48.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "qg0Ur94.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "GC6KR66.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "yM1yn26.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Xu86HZ.exe" file has an entrypoint instructions - "call 0x406a50,jmp 0x4061d1,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x406398,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x406391,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40639d,add edx, 0x28,cmp edx, esi,jne 0x406382,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x40639a,push esi,call 0x406d75,test eax, eax,je 0x4063cb,mov eax, dword ptr fs:[0x18],mov esi, 0x439bc8," "4jh628Nr.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "5hi9dC7.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "2sh2882.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "6Bt6uh0.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329," "1Mj28pv0.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"47:T75a,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "yd0NM48.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "yd0NM48.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yd0NM48.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "qg0Ur94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "qg0Ur94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "qg0Ur94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GC6KR66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "GC6KR66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GC6KR66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "yM1yn26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "yM1yn26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yM1yn26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Mj28pv0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1Mj28pv0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1Mj28pv0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Mj28pv0.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME")48:T1027,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1Mj28pv0.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000380-00000C29-701249159] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00000380-00000C29-701350078] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00000380-00000BC1-701384278] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00007544-00000BC1-702244659] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004412-00000BC1-702922596] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00006152-00000BC1-703667933] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00004916-00000BC1-704424549] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004544-00000C29-705167014] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004544-00000C29-705599339] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004544-00000C29-705719539] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004544-00000C29-705863968] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004544-00000C29-706156131] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004544-00000C29-706197651] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004544-00000C29-706272739] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004544-00000C29-706381123] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004544-00000C29-706437748] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004544-00000C29-706957774] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00000336-00000C29-721557522] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00000336-00000C29-721852153] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000336-00000C29-722010945] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00000336-00000C29-722046299] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00000336-00000C29-722122208] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00000336-00000C29-722302569] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00000336-00000C29-722692177]49:T654,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")4a:T69d,"yd0NM48.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\yd0NM48.exe]- [targetUID: 00000000-00000380] "qg0Ur94.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\qg0Ur94.exe]- [targetUID: 00000000-00004412] "GC6KR66.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\GC6KR66.exe]- [targetUID: 00000000-00006152] "yM1yn26.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\yM1yn26.exe]- [targetUID: 00000000-00006152] "3Xu86HZ.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Xu86HZ.exe]- [targetUID: 00000000-00006152] "4jh628Nr.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4jh628Nr.exe]- [targetUID: 00000000-00000336] "5hi9dC7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5hi9dC7.exe]- [targetUID: 00000000-00007544] "2sh2882.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2sh2882.exe]- [targetUID: 00000000-00004916] "6Bt6uh0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6Bt6uh0.exe]- [targetUID: 00000000-00000380] "1Mj28pv0.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Mj28pv0.exe]- [targetUID: 00000000-00004916] "1Mj28pv0.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1Mj28pv0.exe.log]- [targetUID: 00000000-00004544]4b:T7aa,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")4c:Tf15,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "A1BFE37C9B7AE382A21AF70A149B2F70C983F5875BA8B23EC3CF9B9EDBE96A3A.EXE"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")4d:T518,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"4e:Tbc2,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\CABINET.DLL" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\VERSION.DLL" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\YD0NM48.EXE" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\yd0NM48.exe" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6BT6UH0.EXE" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6Bt6uh0.exe" "yd0NM48.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\QG0UR94.EXE" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qg0Ur94.exe" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5HI9DC7.EXE" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5hi9dC7.exe" "qg0Ur94.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\GC6KR66.EXE" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\GC6KR66.exe" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4JH628NR.EXE" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4jh628Nr.exe" "GC6KR66.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"4f:T5ed,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\A1BFE37C9B7AE382A21AF70A149B2F70C983F5875BA8B23EC3CF9B9EDBE96A3A.EXE.LOCAL" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\YD0NM48.EXE.LOCAL" "yd0NM48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\QG0UR94.EXE.LOCAL" "qg0Ur94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "GC6KR66.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\GC6KR66.EXE.LOCAL" "GC6KR66.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "yM1yn26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\YM1YN26.EXE.LOCAL" "yM1yn26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "1Mj28pv0.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "1Mj28pv0.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "1Mj28pv0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1MJ28PV0.EXE.CONFIG"50:T487,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000336-00000C2A-726224102")51:T440,"15.9.1.22" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37" "77.91.124.55:19071" "0.0.0.0" Potential IP "77.91.124.55" found in string "net.tcp://77.91.124.55:19071/" "77.91.124.55" Potential IP "4.0.0.0" found in string "System.ServiceModel 4.0.0.0" "4.0.0.0" Potential IP "77.91.124.55" found in string "[77.91.124.55, 19071]" Potential IP "77.91.124.55" found in string "A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 77.91.124.55:19071" Potential IP "77.91.124.55" found in string "connection failed because connected host has failed to respond 77.91.124.55:19071." Potential IP "77.91.124.55" found in string "Could not connect to net.tcp://77.91.124.55:19071/. The connection attempt lasted for a time span of 00:00:21.0469329. TCP error code 100" Potential IP "77.91.124.55" found in string "iled because connected host has failed to respond 77.91.124.55:19071."52:T27f7,Heuristic match: "%k.as" Pattern match: "q.sz/tt" Heuristic match: "+c.il" Heuristic match: "7g.je" Heuristic match: ":b.sh" Heuristic match: ".a7f.ad" Heuristic match: "1u.se" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "http://ocsp.globalsign.com/rootr30;/http://secure.globalsign.com/cacert/root-r3.crt06/0-0+%http://crl.globalsign.com/root-r3.crl0g@0" Pattern match: "ixp002.tmp/4jh628nr.exe" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://tempuri.org/" Pattern match: "http://schemas.xmlsoap.org/soap/actor/next" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://www.w3.org/2003/05/soap-envelope/role/ultimatereceiver" Pattern match: "http://www.w3.org/2003/05/soap-envelope/role/next" Pattern match: "http://www.w3.org/2003/05/soap-envelope" Pattern match: "http://schemas.microsoft.com/ws/2005/05/envelope/none" Pattern match: "http://schemas.microsoft.com/ws/2005/05/addressing/none" Pattern match: "http://www.w3.org/2005/08/addressing" Pattern match: "http://www.w3.org/2005/08/addressing/anonymous" Pattern match: "http://www.w3.org/2005/08/addressing/none" Pattern match: "http://www.w3.org/2005/08/addressing/fault" Pattern match: "http://www.w3.org/2005/08/addressing/soap/fault" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/fault" Pattern match: "http://www.w3.org/2005/08/addressing/reply" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm" Pattern match: "http://schemas.microsoft.com/ws/2006/05/rm" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/sequenceacknowledgement" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/ackrequested" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/createsequence" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/createsequenceresponse" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/lastmessage" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/terminatesequence" Pattern match: "https://api.ip.sb/ip" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty" Pattern match: "http://schemas.microsoft.com/2005/12/servicemodel/addressing/anonymous" Pattern match: "http://schemas.microsoft.com/2005/12/servicemodel/addressing/none" Pattern match: "http://schemas.microsoft.com/2011/02/session/onopen" Pattern match: "http://tempuri.org/entity/" Pattern match: "http://tempuri.org/entity/id1" Pattern match: "http://tempuri.org/entity/id1response" Pattern match: "http://tempuri.org/entity/id2" Pattern match: "http://tempuri.org/entity/id2response" Pattern match: "http://tempuri.org/entity/id3" Pattern match: "http://tempuri.org/entity/id3response" Pattern match: "http://tempuri.org/entity/id4" Pattern match: "http://tempuri.org/entity/id4response" Pattern match: "http://tempuri.org/entity/id5" Pattern match: "http://tempuri.org/entity/id5response" Pattern match: "http://tempuri.org/entity/id6" Pattern match: "http://tempuri.org/entity/id6response" Pattern match: "http://tempuri.org/entity/id7" Pattern match: "http://tempuri.org/entity/id7response" Pattern match: "http://tempuri.org/entity/id8" Pattern match: "http://tempuri.org/entity/id8response" Pattern match: "http://tempuri.org/entity/id9" Pattern match: "http://tempuri.org/entity/id9response" Pattern match: "http://tempuri.org/entity/id10" Pattern match: "http://tempuri.org/entity/id10response" Pattern match: "http://tempuri.org/entity/id11" Pattern match: "http://tempuri.org/entity/id11response" Pattern match: "http://tempuri.org/entity/id12" Pattern match: "http://tempuri.org/entity/id12response" Pattern match: "http://tempuri.org/entity/id13" Pattern match: "http://tempuri.org/entity/id13response" Pattern match: "http://tempuri.org/entity/id14" Pattern match: "http://tempuri.org/entity/id14response" Pattern match: "http://tempuri.org/entity/id15" Pattern match: "http://tempuri.org/entity/id15response" Pattern match: "http://tempuri.org/entity/id16" Pattern match: "http://tempuri.org/entity/id16response" Pattern match: "http://tempuri.org/entity/id17" Pattern match: "http://tempuri.org/entity/id17response" Pattern match: "http://tempuri.org/entity/id18" Pattern match: "http://tempuri.org/entity/id18response" Pattern match: "http://tempuri.org/entity/id19" Pattern match: "http://tempuri.org/entity/id19response" Pattern match: "http://tempuri.org/entity/id20" Pattern match: "http://tempuri.org/entity/id20response" Pattern match: "http://tempuri.org/entity/id21" Pattern match: "http://tempuri.org/entity/id21response" Pattern match: "http://tempuri.org/entity/id22" Pattern match: "http://tempuri.org/entity/id22response" Pattern match: "http://tempuri.org/entity/id23" Pattern match: "http://tempuri.org/entity/id23response" Pattern match: "http://tempuri.org/entity/id24" Pattern match: "http://tempuri.org/entity/id24response" Pattern match: "http://schemas.microsoft.com/2003/10/serialization/arrays" Pattern match: "http://schemas.microsoft.com/2003/10/serialization/" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "http://microsoft.com/wsdl/types/" Pattern match: "http://schemas.microsoft.com/net/2005/12/windowscommunicationfoundation/dispatcher/fault" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/"53:T8a5,"GC6KR66.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00006152) "GC6KR66.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00006152) "yM1yn26.exe" called "FindFirstFileA" with parameter %TEMP%\IXP004.TMP\* (UID: 00000000-00004916) "yM1yn26.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00004916) "1Mj28pv0.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004544) "1Mj28pv0.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004544)54:T2197,Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") file/memory contains long string with (Indicator: "rsa2"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp")55:Te25,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")56:T470,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")57:T9d4,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp, 00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")58:Td54,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")59:T624,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")5a:T107b,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")5b:T655,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")5c:T6a8,Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; Source: "00000000-00000336.00000000.109924.00C32000.00000002.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp")5d:T50f,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "yM1yn26.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "1Mj28pv0.exe") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00004544-00000C2A-706955704") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004544-00000C2A-707038175") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00004544-00000C2A-707038238") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")5e:T6d8,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found string "\Device\HarddiskVolume2\a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Indicator: "\Device\"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp")5f:Tac0,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")60:T82e,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")61:T8f7,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000380.00000002.112529.00C91000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000380.00000002.112529.00C91000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004412.00000001.110738.00B21000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004412.00000001.110738.00B21000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")62:T900,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")63:T1183,Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000336.00000000.109924.03260000.00000004.mdmp, 00000000-00000336.00000001.111846.03260000.00000004.mdmp, 00000000-00000336.00000002.113765.03260000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000380.00000001.110609.00630000.00000004.mdmp, 00000000-00000380.00000002.112529.00630000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004412.00000000.108817.03280000.00000004.mdmp, 00000000-00004412.00000001.110738.03280000.00000004.mdmp, 00000000-00004412.00000002.112657.03280000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")64:T451,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000336.00000000.109924.05510000.00000004.mdmp, 00000000-00000336.00000001.111846.05510000.00000004.mdmp, 00000000-00000336.00000002.113765.05510000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000380.00000002.112529.00C9A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004412.00000002.112657.00B2A000.00000002.mdmp")65:T1104,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: yd0NM48.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: yd0NM48.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: yd0NM48.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: yd0NM48.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: yd0NM48.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: qg0Ur94.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: qg0Ur94.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: qg0Ur94.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: qg0Ur94.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: qg0Ur94.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: GC6KR66.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: GC6KR66.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: GC6KR66.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: GC6KR66.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: GC6KR66.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: yM1yn26.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: yM1yn26.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: yM1yn26.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: yM1yn26.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: yM1yn26.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5hi9dC7.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5hi9dC7.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5hi9dC7.exe]66:Tfcb,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\YD0NM48.EXE"; Value: "") "yd0NM48.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\QG0UR94.EXE"; Value: "") "qg0Ur94.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\GC6KR66.EXE"; Value: "") "qg0Ur94.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\4JH628NR.EXE"; Value: "") "GC6KR66.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\YM1YN26.EXE"; Value: "") "GC6KR66.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\3XU86HZ.EXE"; Value: "") "yM1yn26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\1MJ28PV0.EXE"; Value: "") "yM1yn26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\2SH2882.EXE"; Value: "") "3Xu86HZ.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "3Xu86HZ.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")67:T608,"yd0NM48.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\yd0NM48.exe]- [targetUID: 00000000-00000380] "qg0Ur94.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\qg0Ur94.exe]- [targetUID: 00000000-00004412] "GC6KR66.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\GC6KR66.exe]- [targetUID: 00000000-00006152] "yM1yn26.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\yM1yn26.exe]- [targetUID: 00000000-00006152] "3Xu86HZ.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Xu86HZ.exe]- [targetUID: 00000000-00006152] "4jh628Nr.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4jh628Nr.exe]- [targetUID: 00000000-00000336] "5hi9dC7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5hi9dC7.exe]- [targetUID: 00000000-00007544] "2sh2882.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2sh2882.exe]- [targetUID: 00000000-00004916] "6Bt6uh0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6Bt6uh0.exe]- [targetUID: 00000000-00000380] "1Mj28pv0.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Mj28pv0.exe]- [targetUID: 00000000-00004916]68:T495,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "yd0NM48.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "qg0Ur94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "GC6KR66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "yM1yn26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1Mj28pv0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1Mj28pv0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2sh2882.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3Xu86HZ.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "4jh628Nr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "4jh628Nr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")69:T7a3,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" has section name .text with entropy "6.314163792045976" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" has section name .rsrc with entropy "7.9542499081859" "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" has section name .reloc with entropy "6.222637930812128" "yd0NM48.exe" has section name .text with entropy "6.314163792045976" "yd0NM48.exe" has section name .rsrc with entropy "7.942173209479435" "yd0NM48.exe" has section name .reloc with entropy "6.222637930812128" "qg0Ur94.exe" has section name .text with entropy "6.314163792045976" "qg0Ur94.exe" has section name .rsrc with entropy "7.9154146985119835" "qg0Ur94.exe" has section name .reloc with entropy "6.222637930812128" "GC6KR66.exe" has section name .text with entropy "6.314163792045976" "GC6KR66.exe" has section name .rsrc with entropy "7.862490423968339" "GC6KR66.exe" has section name .reloc with entropy "6.222637930812128" "yM1yn26.exe" has section name .text with entropy "6.314163792045976" "yM1yn26.exe" has section name .rsrc with entropy "7.620278284323581" "yM1yn26.exe" has section name .reloc with entropy "6.222637930812128" "3Xu86HZ.exe" has section name .text with entropy "6.6967734308077675" "3Xu86HZ.exe" has section name .data with entropy "7.611931670213631" "3Xu86HZ.exe" has section name .reloc with entropy "6.407432694710559" "4jh628Nr.exe" has section name .text with entropy "6.347609018152964" "5hi9dC7.exe" has section name .text with entropy "6.481477924163614" "5hi9dC7.exe" has section name .reloc with entropy "6.604286353686168" "2sh2882.exe" has section name .text with entropy "6.792540501452876" "2sh2882.exe" has section name .reloc with entropy "6.7904444831249995" "6Bt6uh0.exe" has section name .text with entropy "6.558083729279072" "6Bt6uh0.exe" has section name .rdata with entropy "7.110640338733979"6a:T608,"yd0NM48.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\yd0NM48.exe]- [targetUID: 00000000-00000380] "qg0Ur94.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\qg0Ur94.exe]- [targetUID: 00000000-00004412] "GC6KR66.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\GC6KR66.exe]- [targetUID: 00000000-00006152] "yM1yn26.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\yM1yn26.exe]- [targetUID: 00000000-00006152] "3Xu86HZ.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Xu86HZ.exe]- [targetUID: 00000000-00006152] "4jh628Nr.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4jh628Nr.exe]- [targetUID: 00000000-00000336] "5hi9dC7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5hi9dC7.exe]- [targetUID: 00000000-00007544] "2sh2882.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2sh2882.exe]- [targetUID: 00000000-00004916] "6Bt6uh0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6Bt6uh0.exe]- [targetUID: 00000000-00000380] "1Mj28pv0.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Mj28pv0.exe]- [targetUID: 00000000-00004916]6b:T732,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "yd0NM48.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "yd0NM48.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "qg0Ur94.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "qg0Ur94.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "GC6KR66.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "GC6KR66.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "yM1yn26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "yM1yn26.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"")6c:T1005,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\yd0NM48.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" wrote 25088 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6Bt6uh0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yd0NM48.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qg0Ur94.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yd0NM48.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5hi9dC7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "qg0Ur94.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\GC6KR66.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "qg0Ur94.exe" wrote 30208 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4jh628Nr.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "GC6KR66.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\yM1yn26.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "GC6KR66.exe" wrote 512 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3Xu86HZ.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yM1yn26.exe" wrote 24312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1Mj28pv0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yM1yn26.exe" wrote 8456 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2sh2882.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6d:T729,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "yd0NM48.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "yd0NM48.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "qg0Ur94.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "qg0Ur94.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "qg0Ur94.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "GC6KR66.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "GC6KR66.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "GC6KR66.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "GC6KR66.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "GC6KR66.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3Xu86HZ.exe" with delete access "GC6KR66.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\yM1yn26.exe" with delete access "yM1yn26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "yM1yn26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "yM1yn26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "yM1yn26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "yM1yn26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "yM1yn26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2sh2882.exe" with delete access "yM1yn26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1Mj28pv0.exe" with delete access6e:T4a8,RegCloseKey RegOpenKeyExA OpenProcessToken RegDeleteValueA RegCreateKeyExA FindResourceA CreateDirectoryA DeleteFileA GetVersionExA GetFileAttributesA GetProcAddress FindNextFileA GetTempPathA TerminateProcess CreateThread UnhandledExceptionFilter WriteFile GetDriveTypeA GetModuleHandleW FindFirstFileA GetSystemDirectoryA Sleep GetTempFileNameA LockResource GetStartupInfoW LoadLibraryExA GetModuleFileNameA CreateProcessA CreateFileA GetSystemInfo GetTickCount LoadLibraryA LoadLibraryExW IsDebuggerPresent CreateFileW GetCommandLineA FindNextFileW GetCommandLineW GetModuleHandleExW GetFileSizeEx FindFirstFileExW GetModuleFileNameW LookupAccountNameA GetUserNameA GetThreadContext CopyFileA WriteProcessMemory GetVersionExW GetDriveTypeW GetComputerNameExW VirtualAlloc ReadProcessMemory DeleteFileW GetModuleHandleA VirtualAllocEx ShellExecuteA InternetReadFile InternetOpenUrlA InternetOpenW InternetCloseHandle InternetConnectA HttpSendRequestA InternetOpenA GetTempPathW GetTempFileNameW GetNativeSystemInfo GetSystemDirectoryW LoadLibraryW FindResourceW CreateDirectoryW ShellExecuteExW GetWindowThreadProcessId6f:T5e5,"a1bfe37c9b7ae382a21af70a149b2f70c983f5875ba8b23ec3cf9b9edbe96a3a.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\yd0NM48.exe" (Handle: 660) "yd0NM48.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qg0Ur94.exe" (Handle: 652) "qg0Ur94.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\GC6KR66.exe" (Handle: 660) "qg0Ur94.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4jh628Nr.exe" (Handle: 684) "GC6KR66.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\yM1yn26.exe" (Handle: 660) "GC6KR66.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3Xu86HZ.exe" (Handle: 684) "yM1yn26.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1Mj28pv0.exe" (Handle: 656) "yM1yn26.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2sh2882.exe" (Handle: 124) "3Xu86HZ.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 144) "3Xu86HZ.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 144) "3Xu86HZ.exe" wrote 00007600 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 144)70:Te57,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=jjLe4JT6JCa6Q1NdpWqPContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache"71:Te78,"2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2sh2882.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")72:T52c,"4jh628Nr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4jh628Nr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")73:T6ef,"4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "4jh628Nr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")74:Tdd8,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000940.00000000.76944.00348000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000940.00000000.76944.00348000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000940.00000000.76944.00348000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000940.00000000.76944.00348000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001364.00000000.77240.00330000.00000004.mdmp 00000000-00001364.00000001.79161.00330000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001364.00000000.77240.00330000.00000004.mdmp 00000000-00001364.00000001.79161.00330000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001364.00000000.77240.00330000.00000004.mdmp 00000000-00001364.00000001.79161.00330000.00000004.mdmp 00000000-00001364.00000001.79161.00730000.00000002.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001364.00000000.77240.00330000.00000004.mdmp 00000000-00001364.00000001.79161.00330000.00000004.mdmp 00000000-00001364.00000001.79161.00730000.00000002.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001812.00000000.77307.001A0000.00000004.mdmp 00000000-00001812.00000001.78337.001FD000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001812.00000000.77307.001A0000.00000004.mdmp 00000000-00001812.00000001.78337.001FD000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001812.00000000.77307.001A0000.00000004.mdmp 00000000-00001812.00000001.78337.001FD000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001812.00000000.77307.001A0000.00000004.mdmp 00000000-00001812.00000001.78337.001FD000.00000004.mdmp75:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")76:T865,Found string "+ncalrpc:[OLE0B0300DE08F04C32B0C14481FB58]" (Indicator: "ncalrpc"; Source: "00000000-00001364.00000001.79161.00330000.00000004.mdmp") Found string "I+ncalrpc:[OLEC470EE56380B435694A28AAAA050]" (Indicator: "ncalrpc"; Source: "00000000-00001364.00000001.79161.00330000.00000004.mdmp, 00000000-00001364.00000001.79161.028C9000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001364.00000001.79161.00330000.00000004.mdmp") Found string "+ncalrpc:[OLEC470EE56380B435694A28AAAA050]" (Indicator: "ncalrpc"; Source: "00000000-00001364.00000001.79161.00330000.00000004.mdmp") Found string "+ncalrpc:[OLE73AB5A3521FA4DAFAC5EDD3C9997]" (Indicator: "ncalrpc"; Source: "00000000-00001364.00000001.79161.00330000.00000004.mdmp") Found string "+ncalrpc:[OLE2A05FA4262E04822B6D2CEE06291]" (Indicator: "ncalrpc"; Source: "00000000-00001856.00000000.68818.00290000.00000004.mdmp, 00000000-00001856.00000001.68848.00290000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001856.00000000.68818.00290000.00000004.mdmp, 00000000-00001856.00000001.68848.00290000.00000004.mdmp") Found string "I+ncalrpc:[OLEC470EE56380B435694A28AAAA050]" (Indicator: "ncalrpc"; Source: "00000000-00001856.00000000.68818.00290000.00000004.mdmp, 00000000-00001856.00000001.68848.00290000.00000004.mdmp") Found string "+ncalrpc:[OLEC470EE56380B435694A28AAAA050]" (Indicator: "ncalrpc"; Source: "00000000-00001856.00000000.68818.00290000.00000004.mdmp, 00000000-00001856.00000001.68848.00290000.00000004.mdmp") Found string "A+ncalrpc:[OLE2A05FA4262E04822B6D2CEE06291]" (Indicator: "ncalrpc"; Source: "00000000-00001856.00000000.68818.00290000.00000004.mdmp") Found string "+ncalrpc:[OLEA98F5E865CBE410EA220E8AF8687]" (Indicator: "ncalrpc"; Source: "00000000-00001856.00000000.68818.00290000.00000004.mdmp, 00000000-00001856.00000001.68848.00290000.00000004.mdmp") Found string "A+ncalrpc:[OLE2A05FA4262E04822B6" (Indicator: "ncalrpc"; Source: "00000000-00001856.00000000.68818.00290000.00000004.mdmp")77:T430,"file.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002976) "file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002976) "file.exe" called "FindNextFileW" with parameter 6Bt6uh0.exe (UID: 00000000-00002976) "file.exe" called "FindNextFileW" with parameter yd0NM48.exe (UID: 00000000-00002976) "yd0NM48.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003860) "yd0NM48.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003860) "yd0NM48.exe" called "FindNextFileW" with parameter 5hi9dC7.exe (UID: 00000000-00003860) "yd0NM48.exe" called "FindNextFileW" with parameter qg0Ur94.exe (UID: 00000000-00003860) "yd0NM48.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003860) "yd0NM48.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003860) "qg0Ur94.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00003256) "qg0Ur94.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003256)78:T4001,"initAft()