34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T472,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample c2935dcaaf0c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c2935dcaaf0c…. Malware family: Malware. Threat score 100/100. 4/29 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c2935dcaaf0cf3da6b094666b4c5e4b24369a214bb4bcdcddfec8ea1f5841190","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","c2935dcaaf0cf3da6b094666b4c5e4b24369a214bb4bcdcddfec8ea1f5841190"],"about":{"@type":"SoftwareApplication","name":"UMM2.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"c2935dcaaf0cf3da6b094666b4c5e4b24369a214bb4bcdcddfec8ea1f5841190","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":4,"total":29},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4b9,Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; File: "UMM2") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp")37:T20c7,Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "UMM2") file/memory contains long string with (Indicator: "Oid"; File: "~DF61BB97F2CDD389E1.TMP") Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp")38:T166a,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"39:T4a6,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding3a:Teb6,"UMM2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003216) "UMM2.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003216) "UMM2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000716c30dec20466ffcc0499ffff04ccffff0420dec2040000716c0000000001000000 (UID: 00000000-00003216) "UMM2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011edfd96dfcd0e4c2042a9dc076000000002483d5760400000000000000000000004cf6c20400000000e79cc07602000780e4dec204000000001600000034dfc204feffffffbcdec204cf00f576d600f5767b8b3172160000000b00000034dfc2046f006e0090dec2046e007400f8dec204 (UID: 00000000-00003216) "UMM2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600f5dad6fa34d7c2046d825e761cf2490004010000 (UID: 00000000-00003216) "UMM2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003c00c8ed4a00000000003e00003e340000c0f0ef4a00e0f54a0078a04900f001000000003c0004000000c8ed4a009ce7c2040464f47638013c00e063f4765bb231720000000000003c00d0ed4a006dd10a77ebba81fa6cae2276000000000000000044030000e0f54a00302b3c000100000000003c0050013c000c000000d0ed4a00302b3c00020000021800000041010040820000000000000000000000030000003ce7c20482000000c100000000000000f41b00ef02000000c07512774840780400000000c075127758e7c2046c2b3c0000000000302b3c00b0e7c204ff2bf476 (UID: 00000000-00003216)3b:T6bb,Found reference to API "EnumWindowsProc" (Indicator: "EnumWindows"; File: "UMM2") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; File: "UMM2") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "UMM2") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "UMM2") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "UMM2") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API "EnumWindowsProc" (Indicator: "EnumWindows"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp")3c:T9587,Found reference to API (Indicator: "CreateCompatibleDC"; File: "UMM2") Found reference to API (Indicator: "ReleaseDC"; File: "UMM2") Found reference to API (Indicator: "DeleteDC"; File: "UMM2") Found reference to API (Indicator: "GetDC"; File: "UMM2") Found reference to API (Indicator: "IsIconic"; File: "UMM2") Found reference to API (Indicator: "DefWindowProc"; File: "UMM2") Found reference to API (Indicator: "GetCurrentThreadId"; File: "UMM2") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "UMM2") Found reference to API (Indicator: "GetNamedPipeClientProcessId"; File: "UMM2") Found reference to API (Indicator: "GetCurrentProcessId"; File: "UMM2") Found reference to API (Indicator: "GetCurrentThread"; File: "UMM2") Found reference to API (Indicator: "IsWindowEnabled"; File: "UMM2") Found reference to API (Indicator: "IsZoomed"; File: "UMM2") Found reference to API (Indicator: "IsChild"; File: "UMM2") Found reference to API (Indicator: "LoadResource"; File: "UMM2") Found reference to API (Indicator: "FindResource"; File: "UMM2") Found reference to API (Indicator: "SizeofResource"; File: "UMM2") Found reference to API (Indicator: "LockResource"; File: "UMM2") Found reference to API (Indicator: "LoadImage"; File: "UMM2") Found reference to API (Indicator: "PostThreadMessage"; File: "UMM2") Found reference to API (Indicator: "SendMessage"; File: "UMM2") Found reference to API (Indicator: "TranslateMessage"; File: "UMM2") Found reference to API (Indicator: "IsDialogMessage"; File: "UMM2") Found reference to API (Indicator: "DispatchMessage"; File: "UMM2") Found reference to API (Indicator: "PeekMessage"; File: "UMM2") Found reference to API (Indicator: "PostQuitMessage"; File: "UMM2") Found reference to API (Indicator: "PostMessage"; File: "UMM2") Found reference to API (Indicator: "RegisterWindowMessage"; File: "UMM2") Found reference to API (Indicator: "CopyAcceleratorTable"; File: "UMM2") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "UMM2") Found reference to API (Indicator: "IsWindowVisible"; File: "UMM2") Found reference to API (Indicator: "GetModuleHandle"; File: "UMM2") Found reference to API (Indicator: "CloseHandle"; File: "UMM2") Found reference to API (Indicator: "QueryFullProcessImageName"; File: "UMM2") Found reference to API (Indicator: "GetClassName"; File: "UMM2") Found reference to API (Indicator: "GetMessageTime"; File: "UMM2") Found reference to API (Indicator: "VariantChangeType"; File: "UMM2") Found reference to API (Indicator: "ReleaseCapture"; File: "UMM2") Found reference to API (Indicator: "GetCapture"; File: "UMM2") Found reference to API (Indicator: "SetCapture"; File: "UMM2") Found reference to API (Indicator: "GetKeyboardState"; File: "UMM2") Found reference to API (Indicator: "GetAsyncKeyState"; File: "UMM2") Found reference to API (Indicator: "GetKeyState"; File: "UMM2") Found reference to API (Indicator: "OutputDebugString"; File: "UMM2") Found reference to API (Indicator: "GetWindowLong"; File: "UMM2") Found reference to API (Indicator: "SetWindowLong"; File: "UMM2") Found reference to API (Indicator: "CreateSolidBrush"; File: "UMM2") Found reference to API (Indicator: "GetWindowTextLength"; File: "UMM2") Found reference to API (Indicator: "EnableMenuItem"; File: "UMM2") Found reference to API (Indicator: "ClientToScreen"; File: "UMM2") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "UMM2") Found reference to API (Indicator: "SetWindowRgn"; File: "UMM2") Found reference to API (Indicator: "DestroyIcon"; File: "UMM2") Found reference to API (Indicator: "GetTokenInformation"; File: "UMM2") Found reference to API (Indicator: "SHGetFileInfo"; File: "UMM2") Found reference to API (Indicator: "SystemParametersInfo"; File: "UMM2") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "UMM2") Found reference to API (Indicator: "BringWindowToTop"; File: "UMM2") Found reference to API (Indicator: "RemoveProp"; File: "UMM2") Found reference to API (Indicator: "GetProp"; File: "UMM2") Found reference to API (Indicator: "SetProp"; File: "UMM2") Found reference to API (Indicator: "VariantClear"; File: "UMM2") Found reference to API (Indicator: "GetSysColor"; File: "UMM2") Found reference to API (Indicator: "SetCursor"; File: "UMM2") Found reference to API (Indicator: "GetWindowLongPtr"; File: "UMM2") Found reference to API (Indicator: "SetWindowLongPtr"; File: "UMM2") Found reference to API (Indicator: "GetSystemMetrics"; File: "UMM2") Found reference to API (Indicator: "EnumResourceNames"; File: "UMM2") Found reference to API (Indicator: "GetCursorPos"; File: "UMM2") Found reference to API (Indicator: "SetWindowPos"; File: "UMM2") Found reference to API (Indicator: "GetDeviceCaps"; File: "UMM2") Found reference to API (Indicator: "ShowOwnedPopups"; File: "UMM2") Found reference to API (Indicator: "RegisterClass"; File: "UMM2") Found reference to API (Indicator: "UnregisterClass"; File: "UMM2") Found reference to API (Indicator: "OpenProcess"; File: "UMM2") Found reference to API (Indicator: "GetCurrentProcess"; File: "UMM2") Found reference to API (Indicator: "GetDIBits"; File: "UMM2") Found reference to API (Indicator: "MapWindowPoints"; File: "UMM2") Found reference to API (Indicator: "GetFocus"; File: "UMM2") Found reference to API (Indicator: "SetFocus"; File: "UMM2") Found reference to API (Indicator: "EnumThreadWindows"; File: "UMM2") Found reference to API (Indicator: "EnumChildWindows"; File: "UMM2") Found reference to API (Indicator: "FillRect"; File: "UMM2") Found reference to API (Indicator: "PtInRect"; File: "UMM2") Found reference to API (Indicator: "IntersectRect"; File: "UMM2") Found reference to API (Indicator: "GetClientRect"; File: "UMM2") Found reference to API (Indicator: "GetWindowRect"; File: "UMM2") Found reference to API (Indicator: "DeleteObject"; File: "UMM2") Found reference to API (Indicator: "GetStockObject"; File: "UMM2") Found reference to API (Indicator: "SelectObject"; File: "UMM2") Found reference to API (Indicator: "GetObject"; File: "UMM2") Found reference to API (Indicator: "ScreenToClient"; File: "UMM2") Found reference to API (Indicator: "GetWindowPlacement"; File: "UMM2") Found reference to API (Indicator: "GetParent"; File: "UMM2") Found reference to API (Indicator: "SetParent"; File: "UMM2") Found reference to API (Indicator: "SetEvent"; File: "UMM2") Found reference to API (Indicator: "WindowFromPoint"; File: "UMM2") Found reference to API (Indicator: "GetWindowText"; File: "UMM2") Found reference to API (Indicator: "SetWindowText"; File: "UMM2") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; File: "UMM2") Found reference to API (Indicator: "GetSystemMenu"; File: "UMM2") Found reference to API (Indicator: "UpdateLayeredWindow"; File: "UMM2") Found reference to API (Indicator: "GetForegroundWindow"; File: "UMM2") Found reference to API (Indicator: "SetForegroundWindow"; File: "UMM2") Found reference to API (Indicator: "GetActiveWindow"; File: "UMM2") Found reference to API (Indicator: "SetActiveWindow"; File: "UMM2") Found reference to API (Indicator: "MoveWindow"; File: "UMM2") Found reference to API (Indicator: "GetTopWindow"; File: "UMM2") Found reference to API (Indicator: "GetDesktopWindow"; File: "UMM2") Found reference to API (Indicator: "IsWindow"; File: "UMM2") Found reference to API (Indicator: "GetWindow"; File: "UMM2") Found reference to API (Indicator: "RedrawWindow"; File: "UMM2") Found reference to API (Indicator: "ShowWindow"; File: "UMM2") Found reference to API (Indicator: "DestroyWindow"; File: "UMM2") Found reference to API (Indicator: "GetDCEx"; File: "UMM2") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "UMM2") Found reference to API (Indicator: "SetWindowsHookEx"; File: "UMM2") Found reference to API (Indicator: "CallNextHookEx"; File: "UMM2") Found reference to API (Indicator: "RegisterClassEx"; File: "UMM2") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "UMM2") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "UMM2") Found reference to API (Indicator: "CreateWindowEx"; File: "UMM2") Found reference to API (Indicator: "LoadLibraryEx"; File: "UMM2") Found reference to API (Indicator: "MapVirtualKey"; File: "UMM2") Found reference to API (Indicator: "FreeLibrary"; File: "UMM2") Found reference to API (Indicator: "RtlMoveMemory"; File: "UMM2") Found reference to API (Indicator: "GetSidSubAuthority"; File: "UMM2") Found reference to API (Indicator: "SetThreadPriority"; File: "UMM2") Found reference to API (Indicator: "WaitMessage"; File: "UMM2") Found reference to API (Indicator: "NtResumeThread"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributes"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00003216.00000000.66711.00380000.00000004.mdmp, 00000000-00003216.00000000.66711.02CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.00380000.00000004.mdmp, 00000000-00003216.00000001.66921.02CA0000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProc"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetNamedPipeClientProcessId"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "FindResource"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "LoadImage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "PostThreadMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "IsDialogMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "PeekMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "PostMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "RegisterWindowMessage"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "CopyAcceleratorTable"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetMessageTime"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "VariantChangeType"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugString"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SHGetFileInfo"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SystemParametersInfo"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "RemoveProp"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetProp"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetProp"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "VariantClear"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLongPtr"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLongPtr"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "EnumResourceNames"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "RegisterClass"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClass"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "IntersectRect"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetWindowText"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "UpdateLayeredWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryEx"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "RtlMoveMemory"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00003216.00000000.66711.01CA0000.00000004.mdmp, 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp")3d:T446,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "UMM2") Found reference to API "FindResource" (Indicator: "FindResource"; File: "UMM2") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "UMM2") Found reference to API "LockResource" (Indicator: "LockResource"; File: "UMM2") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API "FindResource" (Indicator: "FindResource"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003216.00000000.66711.00BF2000.00000020.mdmp, 00000000-00003216.00000001.66921.00BF2000.00000020.mdmp")3e:Te3c,"SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00003216.00000000.66711.00BF2000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003216.00000000.66711.003C0000.00000004.mdmp 00000000-00003216.00000001.66921.003C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003216.00000000.66711.003C0000.00000004.mdmp 00000000-00003216.00000001.66921.003C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00003216.00000000.66711.01CA0000.00000004.mdmp 00000000-00003216.00000001.66921.01CA0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003216.00000000.66711.7F6F0000.00000002.mdmp 00000000-00003216.00000001.66921.7F6F0000.00000002.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003216.00000001.66921.003C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003216.00000001.66921.003C0000.00000004.mdmp3f:T544,Observed unmanaged function "SetProcessDpiAwarenessContext" in "UMM2" Observed unmanaged function "SetCursor" in "UMM2" Observed unmanaged function "SetForegroundWindow" in "UMM2" Observed unmanaged function "GetCapture" in "UMM2" Observed unmanaged function "ShowOwnedPopups" in "UMM2" Observed unmanaged function "PostQuitMessage" in "UMM2" Observed unmanaged function "GetGUIThreadInfo" in "UMM2" Observed unmanaged function "GetWindowPlacement" in "UMM2" Observed unmanaged function "GetCursorPos" in "UMM2" Observed unmanaged function "GetSysColor" in "UMM2" Observed unmanaged function "GetSystemMetrics" in "UMM2" Observed unmanaged function "SystemParametersInfo" in "UMM2" Observed unmanaged function "GetSystemMenu" in "UMM2" Observed unmanaged function "TrackPopupMenuEx" in "UMM2" Observed unmanaged function "EnableMenuItem" in "UMM2" Observed unmanaged function "RegisterWindowMessage" in "UMM2" Observed unmanaged function "GetAsyncKeyState" in "UMM2" Observed unmanaged function "GetMessagePos" in "UMM2" Observed unmanaged function "MsgWaitForMultipleObjectsEx" in "UMM2" Observed unmanaged function "GetKeyState" in "UMM2" Observed unmanaged function "GetNamedPipeClientProcessId" in "UMM2" Observed unmanaged function "OpenProcess" in "UMM2" Observed unmanaged function "QueryFullProcessImageName" in "UMM2"40:T502,Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_aspnet_") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_aspnet_") Found string "" (Indicator: "github.com")42:Tcd7,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5599 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 29 Sep 2023 14:58:36 GMT Last-Modified: Fri 29 Sep 2023 13:25:17 GMT Server: ECAcc (sac/253F) X-Cache: HIT Content-Length: 1507 with response body ==>308205DF0A0100A08205D8308205D406092B0601050507300101048205C5308205C130819EA2160414F8B63275C65D2FC64F5EE8A1E6A63A91DA62C5E7180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4925 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 29 Sep 2023 14:58:36 GMT Last-Modified: Fri 29 Sep 2023 13:36:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4925 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 29 Sep 2023 14:58:36 GMT Last-Modified: Fri 29 Sep 2023 13:36:31 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5558 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 29 Sep 2023 14:59:24 GMT Last-Modified: Fri 29 Sep 2023 13:26:46 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4443 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 29 Sep 2023 14:59:24 GMT Last-Modified: Fri 29 Sep 2023 13:45:21 GMT Server: ECAcc (sac/2540) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......43:T12eb,"UMM2.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "UMM2.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "UMM2.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "UMM2.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "UMM2.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "UMM2.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "UMM2.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "UMM2.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "UMM2.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "UMM2.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "UMM2.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "UMM2.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "UMM2.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "UMM2.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "UMM2.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "UMM2.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "UMM2.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "UMM2.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "UMM2.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "UMM2.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "UMM2.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "UMM2.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "UMM2.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "UMM2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "UMM2.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "aspnet_state.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")44:T481,"UMM2" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"45:T2f32,Observed system executable string:"/C:\ PROGRA~2 MICROS~1 WindowsSTARTM~1ProgramsACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pc/C:\ PROGRA~2 MICROS~1 WindowsSTARTM~1ProgramsACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pc/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPShapubws-pc/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPShapubws-pc" [Source: EOWQ2UPNX98OD42CTB7V.temp] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\*.exe" [Source: 00000000-00003216-00000C28-8773736380] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\1033\*.exe" [Source: 00000000-00003216-00000C28-10541979526] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\*.exe" [Source: 00000000-00003216-00000C28-10547624067] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\*.exe" [Source: 00000000-00003216-00000C28-10550739415] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\*.exe" [Source: 00000000-00003216-00000C28-10553827663] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\*.exe" [Source: 00000000-00003216-00000C28-10556671897] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\*.exe" [Source: 00000000-00003216-00000C28-10558739419] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_GlobalResources\*.exe" [Source: 00000000-00003216-00000C28-10560895591] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\*.exe" [Source: 00000000-00003216-00000C28-10564386230] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\*.exe" [Source: 00000000-00003216-00000C28-10569620945] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\*.exe" [Source: 00000000-00003216-00000C28-10572104098] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\*.exe" [Source: 00000000-00003216-00000C28-10574690186] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\*.exe" [Source: 00000000-00003216-00000C28-10577827053] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\*.exe" [Source: 00000000-00003216-00000C28-10580251484] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\*.exe" [Source: 00000000-00003216-00000C28-10582611723] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe" [Source: 00000000-00003216-00000C41-11003372205] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003216-00000C41-18446744066986933071] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\UMM2.exe" -Force" [Source: 00000000-00003216-00000C41-18446744066986933071] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\*.exe" [Source: 00000000-00003216-00000C28-18446744069125474732] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\*.exe" [Source: 00000000-00003216-00000C28-18446744069127851432] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\*.exe" [Source: 00000000-00003216-00000C28-18446744069130157947] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\*.exe" [Source: 00000000-00003216-00000C28-18446744069132749615] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\*.exe" [Source: 00000000-00003216-00000C28-18446744069135359077] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\*.exe" [Source: 00000000-00003216-00000C28-18446744069138721063] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\*.exe" [Source: 00000000-00003216-00000C28-18446744069142074336] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\*.exe" [Source: 00000000-00003216-00000C28-18446744069147668245] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\Browsers\*.exe" [Source: 00000000-00003216-00000C28-18446744069151045582] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\*.exe" [Source: 00000000-00003216-00000C28-18446744069153837099] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MOF\*.exe" [Source: 00000000-00003216-00000C28-18446744069155911905] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild\*.exe" [Source: 00000000-00003216-00000C28-18446744069157689458] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\*.exe" [Source: 00000000-00003216-00000C28-18446744069159285353] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\*.exe" [Source: 00000000-00003216-00000C28-18446744069160943741] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\*.exe" [Source: 00000000-00003216-00000C28-18446744069162607649] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\*.exe" [Source: 00000000-00003216-00000C28-18446744069170407878] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1025\*.exe" [Source: 00000000-00003216-00000C28-18446744069172934405] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1028\*.exe" [Source: 00000000-00003216-00000C28-18446744069175055934] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1029\*.exe" [Source: 00000000-00003216-00000C28-18446744069177213897] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1030\*.exe" [Source: 00000000-00003216-00000C28-18446744069179332470] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1031\*.exe" [Source: 00000000-00003216-00000C28-18446744069181460304] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1032\*.exe" [Source: 00000000-00003216-00000C28-18446744069183576363] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1033\*.exe" [Source: 00000000-00003216-00000C28-18446744069188766164] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1035\*.exe" [Source: 00000000-00003216-00000C28-18446744069190907252] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1036\*.exe" [Source: 00000000-00003216-00000C28-18446744069193040407] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1037\*.exe" [Source: 00000000-00003216-00000C28-18446744069195207545] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1038\*.exe" [Source: 00000000-00003216-00000C28-18446744069197155457] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1040\*.exe" [Source: 00000000-00003216-00000C28-18446744069199167681] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1041\*.exe" [Source: 00000000-00003216-00000C28-18446744069201291812] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1042\*.exe" [Source: 00000000-00003216-00000C28-18446744069203483471] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1043\*.exe" [Source: 00000000-00003216-00000C28-18446744069205617369] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1044\*.exe" [Source: 00000000-00003216-00000C28-18446744069207727361] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1045\*.exe" [Source: 00000000-00003216-00000C28-18446744069209860010] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1046\*.exe" [Source: 00000000-00003216-00000C28-18446744069212006414] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1049\*.exe" [Source: 00000000-00003216-00000C28-18446744069214127066] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1053\*.exe" [Source: 00000000-00003216-00000C28-18446744069216272296] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\1055\*.exe" [Source: 00000000-00003216-00000C28-18446744069218379398] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\2052\*.exe" [Source: 00000000-00003216-00000C28-18446744069218756183] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\2070\*.exe" [Source: 00000000-00003216-00000C28-18446744069218756279] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\3082\*.exe" [Source: 00000000-00003216-00000C28-18446744069220063928] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.8.03761\Graphics\*.exe" [Source: 00000000-00003216-00000C28-18446744069224313317] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SQL\*.exe" [Source: 00000000-00003216-00000C28-18446744069225933143] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SQL\en\*.exe" [Source: 00000000-00003216-00000C28-18446744069229408468] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\*.exe" [Source: 00000000-00003216-00000C28-18446744069231023790] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\*.exe" [Source: 00000000-00003216-00000C28-18446744069239141446] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\en-US\*.exe" [Source: 00000000-00003216-00000C28-18446744069240778970] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\*.exe" [Source: 00000000-00003216-00000C28-18446744069242619265] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00003628-00000C28-4513018282]46:T64d,Found string "" (Indicator: "text/javascript"; File: "D6AHJI8U.htm") Found string "" (Indicator: "text/javascript"; File: "D6AHJI8U.htm") Found string "" (Indicator: "text/javascript"; File: "D6AHJI8U.htm") Found string "" (Indicator: "text/javascript"; File: "D6AHJI8U.htm") Found string "