current" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalrootc:\d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe.configfile:///c:/d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exec:/d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exec:\d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://checkip.dyndns.org/cces:\programdata\microsoft\windows\start" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt05reallyfreegeoip.org*.reallyfreegeoip.org0/0-0+%http://c.pki.goog/we1/ouqgbjkzwhu.crl0?rg" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&0.!z&r'hmtimr8]google" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vj" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0_wp" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!;8kb%2+jo9v" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusqcom1" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn<ijxo" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,<nandx9dmyf1" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=o" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:timr," - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&," - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&timrh\cojr7b41f79-1aec-4782-a6e8-8c28ffba35ed" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:e$e" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:bkg" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:emgr(timrcojrgoogle" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:google" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vg/r4.qglobalsign" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:timrdnsctimrcojrktd'ktd'" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:timrdnsctimrgoogle" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:uahwva=0!7;djb=" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp")44:T539,Found string "name=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005120.00000000.77729.005B0000.00000004.mdmp 00000000-00005120.00000001.78832.005B0000.00000004.mdmp"), Found string "<add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp 00000000-00005120.00000001.78832.01B50000.00000004.mdmp"), Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp"), Found string ";User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005952.00000000.77140.00620000.00000004.mdmp, 00000000-00005952.00000001.77536.00620000.00000004.mdmp") Found string "LEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005952.00000000.77140.00620000.00000004.mdmp 00000000-00005952.00000001.77536.00620000.00000004.mdmp")45:Teac,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005952)46:T4ca,Found string "get_passwordField" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "set_passwordField" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "_password" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp, 00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp")47:T11e4,Found string "Kinza\User Data\Default\Login Data" (Indicator: "kinza\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Sputnik\Sputnik\User Data\Default\Login Data" (Indicator: "sputnik\sputnik\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "MapleStudio\ChromePlus\User Data\Default\Login Data" (Indicator: "maplestudio\chromeplus\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "QIP Surf\User Data\Default\Login Data" (Indicator: "qip surf\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "BlackHawk\User Data\Default\Login Data" (Indicator: "blackhawk\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "7Star\7Star\User Data\Default\Login Data" (Indicator: "7star\7star\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Default\Login Data" (Indicator: "fenrir inc\sleipnir5\setting\modules\chromiumviewer\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "CatalinaGroup\Citrio\User Data\Default\Login Data" (Indicator: "catalinagroup\citrio\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Google\Chrome SxS\User Data\Default\Login Data" (Indicator: "google\chrome sxs\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Coowon\Coowon\User Data\Default\Login Data" (Indicator: "coowon\coowon\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "CocCoc\Browser\User Data\Default\Login Data" (Indicator: "coccoc\browser\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "uCozMedia\Uran\User Data\Default\Login Data" (Indicator: "ucozmedia\uran\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Tencent\QQBrowser\User Data\Default\Login Data" (Indicator: "qqbrowser\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Orbitum\User Data\Default\Login Data" (Indicator: "orbitum\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Slimjet\User Data\Default\Login Data" (Indicator: "slimjet\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Iridium\User Data\Default\Login Data" (Indicator: "iridium\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Vivaldi\User Data\Default\Login Data" (Indicator: "vivaldi\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Chromium\User Data\Default\Login Data" (Indicator: "chromium\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "CentBrowser\User Data\Default\Login Data" (Indicator: "centbrowser\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Xvast\User Data\Default\Login Data" (Indicator: "xvast\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Chedot\User Data\Default\Login Data" (Indicator: "chedot\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "SuperBird\User Data\Default\Login Data" (Indicator: "superbird\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "360Browser\Browser\User Data\Default\Login Data" (Indicator: "360browser\browser\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "360Chrome\Chrome\User Data\Default\Login Data" (Indicator: "360chrome\chrome\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp")48:T640,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005120.00000000.77729.005B0000.00000004.mdmp, 00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}" (Indicator: "\Device\"; Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005952.00000000.77140.00620000.00000004.mdmp, 00000000-00005952.00000001.77536.00620000.00000004.mdmp")49:T1006,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")4a:Tb75,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000")4b:T60f,Found string "<html><head><title>Current IP Check

24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T490,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample d949ca75c623… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d949ca75c623…. Malware family: Lazy.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 13 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f"],"about":{"@type":"SoftwareApplication","name":"CTM USD28600.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb60,Found reference to API "Accepted" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "Automatic format selection set the response format to '{0}', the default value for the operation, as the HTTP client's media-type preference was not provided or could not be honored." (Indicator: "select"; Source: "sample.bin"), Found reference to API "JsonWebScriptServiceHostAtLeastOneServiceContract" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "OperationSelectorNotWebSelector" (Indicator: "select"; Source: "sample.bin"), Found reference to API "ReaderQuotas" (Indicator: "read"; Source: "sample.bin"), Found reference to API "TraceCodeAutomaticFormatSelectedRequestBased" (Indicator: "select"; Source: "sample.bin"), Found reference to API "NThis operation is supported only when the operation selector is of type '{0}'." (Indicator: "select"; Source: "sample.bin"), Found reference to API "The endpoint at '{0}' does not have a Binding with Scheme 'http' or 'https'. '{1}' is only intended for use with WebHttpBinding or similar bindings." (Indicator: "bind"; Source: "sample.bin"), file/memory contains long string with (Indicator: "bind"; Source: "sample.bin"), Found reference to API "TraceCodeRequestFormatSelectedFromContentTypeMapper" (Indicator: "select"; Source: "sample.bin"), Found reference to API "/edmx:Edmx/edmx:Runtime/edmx:Mappings/map:Mapping" (Indicator: "time"; Source: "sample.bin"), Found reference to API "MaxReadPoolSize" (Indicator: "read"; Source: "sample.bin"), Found reference to API "9CrossDomainScriptAccessEnabled cannot be used in Clients." (Indicator: "access"; Source: "sample.bin"), Found reference to API "Link" (Indicator: "link"; Source: "sample.bin"), Found reference to API "TraceCodeAutomaticFormatSelectedOperationDefault" (Indicator: "select"; Source: "sample.bin"), Found reference to API "dateTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "%The '{0}' requires the '{1}' binding." (Indicator: "bind"; Source: "sample.bin"), Found reference to API "FThe get accessor of the '{0}' property is not supported by the stream." (Indicator: "access"; Source: "sample.bin"), Found reference to API "Gateway Time-out" (Indicator: "time"; Source: "sample.bin"), Found reference to API "statusCode" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "crossDomainScriptAccessEnabled" (Indicator: "access"; Source: "sample.bin"), Found reference to API "MaxBytesPerRead" (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "link"; Source: "sample.bin"), Found reference to API "qIn the endpoint at '{0}', in order to use '{1}', the '{2}' of the binding must have ManualAddressing set to true." (Indicator: "bind"; Source: "sample.bin"), Found reference to API "?The {1} binding does not have a configured binding named '{0}'." (Indicator: "bind"; Source: "sample.bin")26:T8f6,Pattern match: "http://schemas.microsoft.com/net/2005/12/windowscommunicationfoundation/dispatcher/fault", Pattern match: "http://www.w3.org/1999/xhtml}pre", Pattern match: "http://schemas.microsoft.com/ado/2008/09/mapping/cs", Pattern match: "http://schemas.datacontract.org/2004/07/", Pattern match: "http://localhost", Pattern match: "http://schemas.microsoft.com/ado/2007/06/edmx", Pattern match: "http://www.w3.org/2001/xmlschema", Pattern match: "http://schemas.microsoft.com/2003/10/serialization/", Pattern match: "http://schemas.microsoft.com/2009/webfault", Pattern match: "http://www.w3.org/1999/xhtml}title", Pattern match: "http://validator.w3.org/feed/docs/rss2.html", Pattern match: "system.web/caching/outputcachesettings", Pattern match: "http://schemas.microsoft.com/ado/2006/04/edm/providermanifest", Pattern match: "http://www.w3.org/2001/xmlschema-instance", Pattern match: "http://www.w3.org/1999/xhtml}body", Pattern match: "http://www.w3.org/1999/xhtml", Pattern match: "http://www.w3.org/1999/xhtml}a", Pattern match: "http://www.w3.org/1999/xhtml}p", Heuristic match: "system.servicemodel.web.diagnostics.application.td", Pattern match: "http://schemas.microsoft.com/ado/2009/02/edm/ssdl", Pattern match: "http://www.rfc-editor.org/rfc/rfc5023.txt", Pattern match: "http://tools.ietf.org/html/rfc4287", Pattern match: "http://www.example.com/", Pattern match: "http://schemas.microsoft.com/ado/2007/12/edm/entitystoreschemagenerator", Pattern match: "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd", Pattern match: "http://www.w3.org/1999/xhtml}html", Pattern match: "http://www.w3.org/1999/xhtml}style", Pattern match: "http://www.w3.org/1999/xhtml}th", Pattern match: "http://www.w3.org/1999/xhtml}td", Pattern match: "http://www.w3.org/1999/xhtml}tr", Pattern match: "http://schemas.microsoft.com/ado/2006/04/codegeneration", Pattern match: "http://schemas.microsoft.com/ado/2009/11/edmx", Pattern match: "http://localhost/", Pattern match: "http://www.w3.org/1999/xhtml}br", Pattern match: "http://schemas.microsoft.com/ado/2008/09/edm", Pattern match: "http://www.w3.org/1999/xhtml}head", Pattern match: "http://www.w3.org/1999/xhtml}table", Pattern match: "http://schemas.microsoft.com/ado/2006/04/edm", Pattern match: "http://www.w3.org/1999/xhtml}div"27:Tebb,Found api reference "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptOpenAlgorithmProvider() failed with status code:{0}" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptGetProperty() (get size) failed with status code:{0}" (Indicator: "BCryptGetProperty"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "Crypt.BCryptGetProperty() failed with status code:{0}" (Indicator: "BCryptGetProperty"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp")28:T884,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005120-00000C2C-231322067") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00005120-00000C2C-231325315") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005120-00000C2C-231325516") Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptOpenAlgorithmProvider() failed with status code:{0}" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp")29:T2fd4,Assembly shows XOR instruction xor cl 06h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor dword ptr [ecx] 20062D12h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor dword ptr [ebp+12002005h] 2008A581h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor dword ptr [ecx+12h] 12020D82h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor eax 11398211h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor eax 05098112h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor byte ptr [edx] dl in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor byte ptr [ebx] cl in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor byte ptr [18020200h] al in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor dword ptr [edx] eax in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor al 1Dh in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor byte ptr [ebp-7EEDFAE3h] EDh in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor cl 0Eh in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor ch 04h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor ch 11h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor ch 06h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor ch 07h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor dword ptr [edi+36AD5638h] edi in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor eax 0E1F0736h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor byte ptr [ecx+18h] 12h in Stream UID: 00000000-00005120-23975-5-0018034E Assembly shows XOR instruction xor dl byte ptr [eax] in Stream UID: 00000000-00005120-23975-17-00172178 Assembly shows XOR instruction xor al 0Eh in Stream UID: 00000000-00005120-23975-17-00172178 Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005120-23975-40-001704EC Assembly shows XOR instruction xor al byte ptr [ecx] in Stream UID: 00000000-00005120-23975-40-001704EC Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00005120-23975-40-001704EC Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005120-23975-42-001702BE Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00005120-23975-42-001702BE Assembly shows XOR instruction xor dword ptr [eax+002B0A07h] esp in Stream UID: 00000000-00005120-23975-42-001702BE Assembly shows XOR instruction xor byte ptr [edx+eax] cl in Stream UID: 00000000-00005120-23975-55-0016EB5B Assembly shows XOR instruction xor cl byte ptr [edx+eax] in Stream UID: 00000000-00005120-23975-55-0016EB5B Assembly shows XOR instruction xor ecx dword ptr [edx+eax] in Stream UID: 00000000-00005120-23975-55-0016EB5B Assembly shows XOR instruction xor eax 7F7B020Ch in Stream UID: 00000000-00005120-23975-55-0016EB5B Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00005120-23975-100-001698A4 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00005120-23975-100-001698A4 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00005120-23975-100-001698A4 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00005120-23975-101-00169700 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00005120-23975-101-00169700 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00005120-23975-102-0016955C Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00005120-23975-102-0016955C Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00005120-23975-104-00169210 Assembly shows XOR instruction xor cl byte ptr [eax] in Stream UID: 00000000-00005120-23975-111-00168478 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005120-23975-111-00168478 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 00000000-00005120-23975-111-00168478 Assembly shows XOR instruction xor eax dword ptr [ecx] in Stream UID: 00000000-00005120-23975-113-00167F68 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005120-23975-113-00167F68 Assembly shows XOR instruction xor byte ptr [ebx+eax] ch in Stream UID: 00000000-00005120-23975-113-00167F68 Assembly shows XOR instruction xor dword ptr [eax] ebp in Stream UID: 00000000-00005120-23975-113-00167F68 Assembly shows XOR instruction xor dl byte ptr [ecx] in Stream UID: 00000000-00005120-23975-113-00167F68 Assembly shows XOR instruction xor bh byte ptr [edx] in Stream UID: 00000000-00005120-23975-113-00167F68 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00005120-23975-113-00167F68 Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005120-23975-113-00167F68 Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00005120-23975-116-00167498 Assembly shows XOR instruction xor byte ptr [edx] cl in Stream UID: 00000000-00005120-23975-116-00167498 Assembly shows XOR instruction xor byte ptr [ecx] cl in Stream UID: 00000000-00005120-23975-116-00167498 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 00000000-00005120-23975-116-00167498 Assembly shows XOR instruction xor byte ptr [0000A700h] al in Stream UID: 00000000-00005120-23975-116-00167498 Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005120-23975-128-001652D8 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00005120-23975-128-001652D8 Assembly shows XOR instruction xor byte ptr [ecx] cl in Stream UID: 00000000-00005120-23975-128-001652D8 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00005120-23975-128-001652D8 Assembly shows XOR instruction xor dword ptr [ecx] eax in Stream UID: 00000000-00005120-23975-128-001652D8 Assembly shows XOR instruction xor byte ptr [ecx] cl in Stream UID: 00000000-00005120-23975-131-00164E94 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00005120-23975-131-00164E94 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00005120-23975-134-001645F2 Assembly shows XOR instruction xor dword ptr [eax+00001700h] ebx in Stream UID: 00000000-00005120-23975-138-00164202 Assembly shows XOR instruction xor dword ptr [eax+00001700h] ebx in Stream UID: 00000000-00005120-23975-139-00164106 Assembly shows XOR instruction xor dword ptr [eax+00001700h] ebx in Stream UID: 00000000-00005120-23975-140-0016400A Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005120-23975-145-00162E12 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00005120-23975-145-00162E12 Assembly shows XOR instruction xor al 0Dh in Stream UID: 00000000-00005120-23975-145-00162E12 Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 00000000-00005120-23975-145-00162E12 Assembly shows XOR instruction xor byte ptr [00005E00h] al in Stream UID: 00000000-00005120-23975-145-00162E12 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00005120-23975-145-00162E12 Assembly shows XOR instruction xor byte ptr [0000AA00h] al in Stream UID: 00000000-00005120-23975-145-00162E12 Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [0000FF00h] al in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor eax 140A0000h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor eax 6F0A0000h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor eax 730A0000h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor dword ptr [ecx+02000000h] ecx in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [eax] 00h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [ecx] 00h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [edx] 00h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [ebx] 00h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [eax+eax] 00h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor byte ptr [esi] 00h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor dword ptr [esi+ebx*8+58170779h] esi in Stream UID: 00000000-00005120-23975-149-00162070 Assembly shows XOR instruction xor eax ebx in Stream UID: 00000000-00005120-23975-201-0017237E Assembly shows XOR instruction xor ch byte ptr [ecx] in Stream UID: 00000000-00005120-23975-201-0017237E Assembly shows XOR instruction xor eax 000D3FD5h in Stream UID: 00000000-00005120-23975-201-0017237E Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00005120-23975-201-0017237E Assembly shows XOR instruction xor ch byte ptr [edi] in Stream UID: 00000000-00005120-23975-201-0017237E Assembly shows XOR instruction xor byte ptr [ebx] bl in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor byte ptr [edi] bh in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor eax 00D5032Eh in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor bl byte ptr [eax+01h] in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor al ah in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor eax EC02CE03h in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor byte ptr [ebx] dh in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor eax 00000001h in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor eax 014002CEh in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor ecx dword ptr [ebx+00014404h] in Stream UID: 00000000-00005120-23975-208-0017373A Assembly shows XOR instruction xor dword ptr [esi] ecx in Stream UID: 00000000-00005120-23975-223-00175458 Assembly shows XOR instruction xor dword ptr [01351548h] edx in Stream UID: 00000000-00005120-23975-223-00175458 Assembly shows XOR instruction xor bl ah in Stream UID: 00000000-00005120-23975-294-00179229 Assembly shows XOR instruction xor dword ptr [edx] FFFFFFEFh in Stream UID: 00000000-00005120-23975-319-0017998E Assembly shows XOR instruction xor ch bh in Stream UID: 00000000-00005120-23975-319-0017998E2a:T5be,Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp")2b:T681,Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org"2c:T6dd,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Able to decrypt/decode data Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption2d:T80e,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000250d7660001730072000000000000000000000000800000000000000001730072e07767000100000000000000020000000c000000d0316700d0316700cb316700000000000000000000006200000000019cef130000000000bcf5130095e17f77f0da1a00feffffff435c83775059837794000000a0000000ca316700c83167009400000040f11300fdfebc7520ea130001000000bcf5130092e0d9699ee42637feffffffd8f013004c9cd9695c0c0000ecf013005f9cd9690000000000000000 (UID: 00000000-00005952)2e:Td7e,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c0053009852660006000006624f000050d7660050a36600509367007c936700a8936700d4936700009467002c94670058946700849467000b00010a324f0008b8956700e4956700109667003c9667006896670094966700c0966700 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6837744208a77f42e3a72a8406600a0353a72b4208a77c4e8130098196600b2f48377a4208a77d4e8130000003372000033720000000030e81300f0000000f00033720000000040e8130053000000d4e913000000000001000000a4e8130040f58377000000000000000090e81300 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c472074d82c6c008c47207400000000d82c6c005cdb1300086d837718818b770000000010dc130000000000de541a659cdb130095e17f7718d91a00feffffff6b2c84773119777502100000000000000000010070db1300c89f83778c4720740000000000000000 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000002300000094040000000000001f000000b3040000b3043ce21300c02b6c00b8e3130095e17f7718d91a00feffffff6b2c847731197775021000000000000000000400001000000300000000000000100000000100000048e31300661e0e730000b30408000000 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300e8d45f0011000011989500001893600050fd5e00b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebd575d09ab3040050fd7f9a5c847700f0fd7fd8ba15004450fd7f00000000400000003f0000002f0000000050fd7fccba1500c15c847760828b772f0000000050fd7f9a5c847700f0fd7ff0ba15005789837780838b7713177775d8ebd575 (UID: 00000000-00005120)2f:Td34,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")30:T865,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")31:T6069,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter MsftEdit.DLL (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MsftEdit.DLL (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005120)32:T16f4f,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipCreateStringFormat (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatAlign (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatLineAlign (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatHotkeyPrefix (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetStringFormatFlags (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatFlags (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetStringFormatTrimming (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetStringFormatHotkeyPrefix (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetStringFormatAlign (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetStringFormatLineAlign (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipDeleteStringFormat (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ImageList_WriteEx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipGetDpiX (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatTrimming (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GdipMeasureString (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SysAllocStringLenW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SystemFunction041W (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetSignatureInterface (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005120) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005120) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004244) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004244) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004244) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004244)33:T138a,Found reference to API (Indicator: "GetObject"; File: "00000000-00005952.00000001.77536.003A2000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00005120.00000000.77729.003A2000.00000020.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "SetWindowsHookExA"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found reference to API (Indicator: "InitializeSecurityContext"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp")34:T111c,"BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00005120.00000001.78832.00162000.00000020.mdmp "AVAST Software\Browser\User Data\Default\Login Data" in Source: 00000000-00005120.00000001.78832.00162000.00000020.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005120.00000001.78832.04AC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005120.00000001.78832.04AC0000.00000004.mdmp35:T1037,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]36:T15af,"BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00005120.00000001.78832.00162000.00000020.mdmp "AVAST Software\Browser\User Data\Default\Login Data" in Source: 00000000-00005120.00000001.78832.00162000.00000020.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00005120.00000001.78832.01B50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005120.00000001.78832.04AC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005120.00000001.78832.04AC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005952.00000001.77536.00620000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005952.00000001.77536.00620000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005952.00000001.77536.01D20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005952.00000001.77536.01D20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005952.00000001.77536.01D20000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005952.00000001.77536.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005952.00000001.77536.01D20000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00005952.00000001.77536.02D20000.00000004.mdmp "AVAST Software\Browser\User Data\Default\Login Data" in Source: 00000000-00005952.00000001.77536.02D20000.00000004.mdmp37:Tbc4,"GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sun 13 Sep 2026 16:33:35 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Sun 13 Sep 2026 16:33:36 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Sun 13 Sep 2026 16:33:39 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sun 13 Sep 2026 16:33:40 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sun 13 Sep 2026 16:33:42 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sun 13 Sep 2026 16:33:44 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420.......38:T3575,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71d70000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "KERNEL32" at base 75b80000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "ADVAPI32.DLL" at base 77010000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bf40000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "SHLWAPI.DLL" at base 75d70000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "VERSION.DLL" at base 74b80000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 650b0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "USER32.DLL" at base 76060000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "MSCOREE.DLL" at base 6bfd0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "PSAPI.DLL" at base 77970000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "RPCRT4.DLL" at base 77980000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "KERNEL32.DLL" at base 75b80000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63ca0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "OLE32.DLL" at base 770c0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "CRYPTBASE.DLL" at base 755e0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74540000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74530000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69de0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63240000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 68830000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 623d0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6ef30000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61bb0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69c50000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 61430000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "NTDLL.DLL" at base 777e0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "SHELL32.DLL" at base 76160000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77950000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "PROFAPI.DLL" at base 756f0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "BCRYPT.DLL" at base 75200000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "CRYPTSP.DLL" at base 750f0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74e80000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "IMM32.DLL" at base 76e50000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "COMCTL32.DLL" at base 72330000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "GDI32.DLL" at base 75dd0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "ADVAPI32" at base 77010000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 61240000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75590000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "GDIPLUS.DLL" at base 74090000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 74090000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75b80000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "MSFTEDIT.DLL" at base 730e0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77950000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "RPCRTREMOTE.DLL" at base 75680000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62890000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74520000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69cd0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 64650000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 644a0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61a20000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61200000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 642b0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d490000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 688d0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60a80000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "RASAPI32.DLL" at base 6c210000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "RTUTILS.DLL" at base 73940000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77950000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77950000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "WS2_32.DLL" at base 77220000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 750b0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74c10000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 750a0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "RASMAN.DLL" at base 6d430000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "WINHTTP.DLL" at base 71d10000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "SSPICLI.DLL" at base 75570000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "CREDSSP.DLL" at base 74db0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "IPHLPAPI.DLL" at base 723d0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "DHCPCSVC6.DLL" at base 716f0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "DHCPCSVC.DLL" at base 71670000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "NSI.DLL" at base 75c60000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "CFGMGR32.DLL" at base 75920000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "OLEAUT32.DLL" at base 76db0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77950000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "DNSAPI.DLL" at base 74f70000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "RASADHLP.DLL" at base 6ce80000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71700000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "SECUR32.DLL" at base 75420000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74ef0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "NCRYPT.DLL" at base 75220000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74dc0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "CRYPT32.DLL" at base 757d0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "USERENV.DLL" at base 75710000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "GPAPI.DLL" at base 74cc0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "PROPSYS.DLL" at base 74390000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "COMCTL32.DLL" at base 745e0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "APPHELP.DLL" at base 75590000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "CLBCATQ.DLL" at base 75af0000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6ad70000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74390000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "NTMARTA.DLL" at base 74b50000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "SETUPAPI.DLL" at base 76e70000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75910000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77260000 "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75750000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6871000039:T11e5,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}")3a:T4bd,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3b:Tbfb,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN")3c:Tfc2,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005952-00000C2B-210745629] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005952-00000C2B-211091448] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005952-00000C2B-212488134] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005952-00000C2B-212627508] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005952-00000C2B-212910421] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005952-00000C2B-212979912] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005952-00000C2B-213121763] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005952-00000C2B-213455764] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005952-00000C2B-213809901] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005952-00000C2B-213886419] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005952-00000C2B-213985616] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005952-00000C2B-214565714] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005952-00000C2B-214630074] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005952-00000C2B-214695114] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005952-00000C2B-214773499] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005952-00000C2B-214921618] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005952-00000C2B-214988520] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005952-00000C2B-215066269] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005952-00000C2B-215503127] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005952-00000C2B-216609784] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00005952-00000C2B-218941730] Observed system executable string:"%WINDIR%\system32\MsftEdit.DLL" [Source: 00000000-00005952-00000C2B-219578256] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005120-00000C2B-222543568] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005120-00000C2B-222894190] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00005120-00000C2B-223144910]3d:T9db,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")3e:T1025,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "D949CA75C623DF13FEE31C1DDFBE02655D866A5408F3140E250090F213EC2F3F"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "")3f:T6e5,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"40:Tcfc,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\FLTLIB.DLL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\MSVCP140.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\VCRUNTIME140.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\ucrtbase.DLL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"41:Tcf7,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\MSVCP140.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\ucrtbase.DLL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"42:T8b3,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe.config" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Fatest\" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.INI" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe.Local\" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\D949CA75C623DF13FEE31C1DDFBE02655D866A5408F3140E250090F213EC2F3F.EXE.CONFIG" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\FATEST" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\D949CA75C623DF13FEE31C1DDFBE02655D866A5408F3140E250090F213EC2F3F.INI" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" trying to access non-existent file "C:\D949CA75C623DF13FEE31C1DDFBE02655D866A5408F3140E250090F213EC2F3F.EXE.LOCAL"43:T39c3,Found URL "http://www.w3.org/1999/xhtml" - Source: "00000000-00005120.00000000.77729.003A2000.00000020.mdmp") Found URL "http://i.pki.goog/we1.crt05reallyfreegeoip.org*.reallyfreegeoip.org0/0-0+%http://c.pki.goog/we1/ouqgbjkzwhu.crl0?rg" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:0l1" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found URL "http://103.130.147.852024-06-26.txt$%smtpdv$$$hash" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://checkip.dyndns.org/current" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalrootc:\d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe.configfile:///c:/d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exec:/d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exec:\d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found URL "http://checkip.dyndns.org/cces:\programdata\microsoft\windows\start" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt05reallyfreegeoip.org*.reallyfreegeoip.org0/0-0+%http://c.pki.goog/we1/ouqgbjkzwhu.crl0?rg" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&0.!z&r'hmtimr8]google" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vj" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0_wp" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!;8kb%2+jo9v" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusqcom1" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn<ijxo" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,<nandx9dmyf1" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=o" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:timr," - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&," - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&timrh\cojr7b41f79-1aec-4782-a6e8-8c28ffba35ed" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:e$e" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:bkg" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:emgr(timrcojrgoogle" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:google" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vg/r4.qglobalsign" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:timrdnsctimrcojrktd'ktd'" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:timrdnsctimrgoogle" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:uahwva=0!7;djb=" - Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp")44:T539,Found string "name=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005120.00000000.77729.005B0000.00000004.mdmp 00000000-00005120.00000001.78832.005B0000.00000004.mdmp"), Found string "<add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp 00000000-00005120.00000001.78832.01B50000.00000004.mdmp"), Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp"), Found string ";User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005952.00000000.77140.00620000.00000004.mdmp, 00000000-00005952.00000001.77536.00620000.00000004.mdmp") Found string "LEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005952.00000000.77140.00620000.00000004.mdmp 00000000-00005952.00000001.77536.00620000.00000004.mdmp")45:Teac,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005952) "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005952)46:T4ca,Found string "get_passwordField" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "set_passwordField" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "_password" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp, 00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp")47:T11e4,Found string "Kinza\User Data\Default\Login Data" (Indicator: "kinza\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Sputnik\Sputnik\User Data\Default\Login Data" (Indicator: "sputnik\sputnik\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "MapleStudio\ChromePlus\User Data\Default\Login Data" (Indicator: "maplestudio\chromeplus\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "QIP Surf\User Data\Default\Login Data" (Indicator: "qip surf\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "BlackHawk\User Data\Default\Login Data" (Indicator: "blackhawk\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "7Star\7Star\User Data\Default\Login Data" (Indicator: "7star\7star\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Default\Login Data" (Indicator: "fenrir inc\sleipnir5\setting\modules\chromiumviewer\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "CatalinaGroup\Citrio\User Data\Default\Login Data" (Indicator: "catalinagroup\citrio\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Google\Chrome SxS\User Data\Default\Login Data" (Indicator: "google\chrome sxs\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Coowon\Coowon\User Data\Default\Login Data" (Indicator: "coowon\coowon\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "CocCoc\Browser\User Data\Default\Login Data" (Indicator: "coccoc\browser\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "uCozMedia\Uran\User Data\Default\Login Data" (Indicator: "ucozmedia\uran\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Tencent\QQBrowser\User Data\Default\Login Data" (Indicator: "qqbrowser\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Orbitum\User Data\Default\Login Data" (Indicator: "orbitum\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Slimjet\User Data\Default\Login Data" (Indicator: "slimjet\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Iridium\User Data\Default\Login Data" (Indicator: "iridium\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Vivaldi\User Data\Default\Login Data" (Indicator: "vivaldi\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Chromium\User Data\Default\Login Data" (Indicator: "chromium\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "CentBrowser\User Data\Default\Login Data" (Indicator: "centbrowser\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Xvast\User Data\Default\Login Data" (Indicator: "xvast\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "Chedot\User Data\Default\Login Data" (Indicator: "chedot\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "SuperBird\User Data\Default\Login Data" (Indicator: "superbird\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "360Browser\Browser\User Data\Default\Login Data" (Indicator: "360browser\browser\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp") Found string "360Chrome\Chrome\User Data\Default\Login Data" (Indicator: "360chrome\chrome\user data\default\login data"; Source: "00000000-00005120.00000001.78832.00162000.00000020.mdmp")48:T640,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005120.00000000.77729.005B0000.00000004.mdmp, 00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.005B0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}" (Indicator: "\Device\"; Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005120.00000001.78832.04AC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005952.00000000.77140.00620000.00000004.mdmp, 00000000-00005952.00000001.77536.00620000.00000004.mdmp")49:T1006,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")4a:Tb75,"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000")4b:T60f,Found string "<html><head><title>Current IP CheckCurrent IP Address: 64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "le>Current IP CheckCurrent IP Address: 64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "Current IP Address: 64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "Current IP Address: 64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "Client IP: 64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "https://reallyfreegeoip.org/xml/64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "/xml/64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "64.124.12.162" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp") Found string "GET /xml/64.124.12.162 HTTP/1.1" (Indicator: "64.124.12.162"; Source: "00000000-00005120.00000001.78832.01B50000.00000004.mdmp")4c:T677,Wrote 1 instructions to a remote process Wrote 1135 instructions to a remote process Wrote 108 instructions to a remote process Wrote 185 instructions to a remote process Wrote 12 instructions to a remote process Wrote 2 instructions to a remote process Wrote 218 instructions to a remote process Wrote 8 instructions to a remote process Wrote 219 instructions to a remote process Wrote 7 instructions to a remote process Wrote 250 instructions to a remote process Wrote 256 instructions to a remote process Wrote 15 instructions to a remote process Wrote 3 instructions to a remote process Wrote 24 instructions to a remote process Wrote 1094 instructions to a remote process Wrote 9 instructions to a remote process Wrote 280 instructions to a remote process Wrote 138 instructions to a remote process Wrote 186 instructions to a remote process Wrote 196 instructions to a remote process Wrote 339 instructions to a remote process Wrote 72 instructions to a remote process Wrote 523 instructions to a remote process Wrote 741 instructions to a remote process Wrote 66 instructions to a remote process Wrote 239 instructions to a remote process Wrote 416 instructions to a remote process Wrote 14 instructions to a remote process Wrote 67 instructions to a remote process Wrote 197 instructions to a remote process Wrote 425 instructions to a remote process Wrote 133 instructions to a remote process Wrote 113 instructions to a remote process Wrote 1309 instructions to a remote process Wrote 1585 instructions to a remote process Wrote 1617 instructions to a remote process Wrote 29 instructions to a remote process4d:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790609865733,"unified_at":"2026-09-28T15:37:45.733Z","metadata":{"hashes":{"sha256":"d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f","sha1":"59c8d3214fb772ef91642d954f7d3642243ff565","md5":"5deba7bbc15bb31bd266e81e902ad15f","sha512":"5268860fdbd15d85ad0ff83b3f45b90f8303fb2d67e733d358b4e18654b5fd2ba8710346ffd9a71727a96166a80991bc0af8cb684e66b87682e3f704603b1eff","ssdeep":"12288:6YydsNXjfbZA0bWaFkzmHf0FBq9QcREKrPJscT7cFnU:63sVsaFkzSkaQcEMJs5Fn","ssdeep_chunks":["12288:6YydsNX","12288:YydsNXj","12288:ydsNXjf","12288:dsNXjfb","12288:sNXjfbZ","12288:NXjfbZA","12288:XjfbZA0","12288:jfbZA0b","12288:fbZA0bW","12288:bZA0bWa","12288:ZA0bWaF","12288:A0bWaFk","12288:0bWaFkz","12288:bWaFkzm","12288:WaFkzmH","12288:aFkzmHf","12288:FkzmHf0","12288:kzmHf0F","12288:zmHf0FB","12288:mHf0FBq","12288:Hf0FBq9","12288:f0FBq9Q","12288:0FBq9Qc","12288:FBq9QcR","12288:Bq9QcRE","12288:q9QcREK","12288:9QcREKr","12288:QcREKrP","12288:cREKrPJ","12288:REKrPJs","12288:EKrPJsc","12288:KrPJscT","12288:rPJscT7","12288:PJscT7c","12288:JscT7cF","12288:scT7cFn","12288:cT7cFnU","24576:6YydsNX","24576:YydsNXj","24576:ydsNXjf","24576:dsNXjfb","24576:sNXjfbZ","24576:NXjfbZA","24576:XjfbZA0","24576:jfbZA0b","24576:fbZA0bW","24576:bZA0bWa","24576:ZA0bWaF","24576:A0bWaFk","24576:0bWaFkz","24576:bWaFkzm","24576:WaFkzmH","24576:aFkzmHf","24576:FkzmHf0","24576:kzmHf0F","24576:zmHf0FB","24576:mHf0FBq","24576:Hf0FBq9","24576:f0FBq9Q","24576:0FBq9Qc","24576:FBq9QcR","24576:Bq9QcRE","24576:q9QcREK","24576:9QcREKr","24576:QcREKrP","24576:cREKrPJ","24576:REKrPJs","24576:EKrPJsc","24576:KrPJscT","24576:rPJscT7","24576:PJscT7c","24576:JscT7cF","24576:scT7cFn","24576:cT7cFnU","12288:63sVsaF","12288:3sVsaFk","12288:sVsaFkz","12288:VsaFkzS","12288:saFkzSk","12288:aFkzSka","12288:FkzSkaQ","12288:kzSkaQc","12288:zSkaQcE","12288:SkaQcEM","12288:kaQcEMJ","12288:aQcEMJs","12288:QcEMJs5","12288:cEMJs5F","12288:EMJs5Fn"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"CTM USD28600.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":652800,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1718016612000,"last_seen":1789317176000,"last_multi_scan":1789317176000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":82},"sandbox_signatures":{"informative_count":170,"suspicious_count":10,"malicious_count":13,"total":193},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.539976","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.539976 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Spy.Agent.AES trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Crypt.gen.ahbg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Sabsik.dd!ni","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.ke!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 005690661 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-AFZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.KZU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3955766","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","identifiers":[{"type":"suspicious","value":"Able to evade execution by checking for blacklisted external IPs"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Deletes file or directory"},{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Chromium browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"malicious","value":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"ysmbl@nmx.ysc\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6d037eec501e02803a404"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ysmbl@nmx.ysc