21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T429,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample d995cbebb6fb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d995cbebb6fb…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa"],"about":{"@type":"SoftwareApplication","name":"TNODUP-Portable.exe","applicationCategory":["peexe","executable"],"identifier":"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":6,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4d5,Heuristic match: "t3;{(r.Ph" Pattern match: "https://edf.eset.com:443/edf" Pattern match: "http://iploc.eset.com:80/ip_locate_iso2" Pattern match: "http://jimmac.musichall.cz" Pattern match: "www.inkscape.org" Pattern match: "www.tukero.org" Pattern match: "http://www.tukero.org/" Pattern match: "www.getyourserial.forumpro.eu" Pattern match: "http://www.eset.com/2012/02/ecp" Heuristic match: "Bshorturls.tukero.org" Pattern match: "http://expire.eset.com/getlicexp" Pattern match: "https://my.eset.com/convert?culture=en-us" Heuristic match: "um11.eset.com" Pattern match: "http://new_url" Pattern match: "http://www.google.com" Pattern match: "http://www.microsoft.com/whdc/ddk/debugging/" Heuristic match: "parolla qorunur.US" Heuristic match: "girer.AE" Pattern match: "http://www.none-ip.info/browse.php?u=Oi8vbm9kMzJuZXcucGVyc2lhbmJsb2cuaXIvcnNzLnhtbA%3D%3D&b=5&f=norefer;http://www.none-ip.info/browse.php?u=Oi8vd3d3LmhodXUubmV0Lw%3D%3D&b=5&f=norefer" Pattern match: "http://www.openssl.org/support/faq.html" Heuristic match: "ftp@example.com" Pattern match: "https://curl.haxx.se/docs/http-cookies.html" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://www.w3.org/2000/xmlns/"23:T562,"RC4" (Indicator: "rc4"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "ECDSA" (Indicator: "ecdsa"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "DES" (Indicator: "des"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "des" (Indicator: "des"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "blowfish" (Indicator: "blowfish"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "AES128" (Indicator: "aes128"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "aes128" (Indicator: "aes128"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "AES192" (Indicator: "aes192"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "aes192" (Indicator: "aes192"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "AES256" (Indicator: "aes256"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "aes256" (Indicator: "aes256"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") "rc4" (Indicator: "rc4"; File: "00025012-00003952.00000001.25883.00778000.00000002.mdmp") "ecdsa" (Indicator: "ecdsa"; File: "00025012-00003952.00000001.25883.00778000.00000002.mdmp")24:T97b,"TNODUP-Portable.exe" wrote bytes "d83aa274" to virtual address "0x74A301E0" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "b436a274" to virtual address "0x74A30200" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "b4360200" to virtual address "0x74A24EA4" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "b436a274" to virtual address "0x74A301E4" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "b830126a73ffe0" to virtual address "0x752F1368" (part of module "WS2_32.DLL") "TNODUP-Portable.exe" wrote bytes "c0df18771cf91777ccf817770d64197700000000c011c07600000000fc3ec07600000000e013c076000000009457d27625e01877c6e0187700000000bc6ad17600000000cf31c076000000009319d276000000002c32c07600000000" to virtual address "0x754A1000" (part of module "NSI.DLL") "TNODUP-Portable.exe" wrote bytes "b4360200" to virtual address "0x74A24D68" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "68130000" to virtual address "0x752F1680" (part of module "WS2_32.DLL") "TNODUP-Portable.exe" wrote bytes "b8c0156a73ffe0" to virtual address "0x74A236B4" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "7111eb007a3bea00ab8b02007f950200fc8c0200729602006cc805001ecde7007d26e700" to virtual address "0x763307E4" (part of module "USER32.DLL") "TNODUP-Portable.exe" wrote bytes "d83aa274" to virtual address "0x74A30274" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "60126a73" to virtual address "0x735F4028" (part of module "WEBIO.DLL") "TNODUP-Portable.exe" wrote bytes "60126a73" to virtual address "0x751DE324" (part of module "WININET.DLL") "TNODUP-Portable.exe" wrote bytes "b840136a73ffe0" to virtual address "0x74A23AD8" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "d83a0200" to virtual address "0x74A24E38" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "d83a0200" to virtual address "0x74A24D78" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "d83aa274" to virtual address "0x74A30258" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "b436a274" to virtual address "0x74A30278" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "b436a274" to virtual address "0x74A3025C" (part of module "SSPICLI.DLL") "TNODUP-Portable.exe" wrote bytes "d83aa274" to virtual address "0x74A301FC" (part of module "SSPICLI.DLL")25:T81c,Found reference to API "unexpected MsgWaitForMultipleObjects() return value %lu" (Indicator: "WaitForMultipleObjects"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "unexpected MsgWaitForMultipleObjects() return value %lu" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")26:T811,Found reference to API "FreeLibrary(wsock2) failed (%u)" (Indicator: "FreeLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FreeLibrary(wsock2) failed (%u)" (Indicator: "FreeLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")27:Tebe,Found string "?ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "?ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "?ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "?ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp, 00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp, 00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found string "@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")28:Tbee,Found reference to "HMAC routines" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "HMAC-MD5" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "RC2-OFB" (Indicator: "RC2"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "RC2-40-CBC" (Indicator: "RC2"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "RC4-HMAC-MD5" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "AES-192-CBC-HMAC-SHA1" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "AES-256-CBC-HMAC-SHA1" (Indicator: "HMAC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to "pbeWithSHA1And3-KeyTripleDES-CBC" (Indicator: "TripleDES"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")29:Tdf2,Found string "SSL public key does not match pinned public key" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "public key hash: sha256//%s" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "unable to set private key file: '%s' type %s" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "file type ENG for private key not supported" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "file type P12 for private key not supported" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "not supported file type for private key" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Private key does not match the certificate public key" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Private key does not match the certificate public key" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Public Key Algorithm" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Unable to load public key" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "RSA Public Key" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "SSL: public key does not match pinned public key!" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "unable to decode issuer public key" (Indicator: "public key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "X509v3 Private Key Usage Period" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "RSA PRIVATE KEY" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "DSA PRIVATE KEY" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "EC PRIVATE KEY" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "PRIVATE KEY" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "encryptedKey" (Indicator: "encryptedkey"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "CMS_RecipientEncryptedKey" (Indicator: "encryptedkey"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "recipientEncryptedKeys" (Indicator: "encryptedkey"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "no private key assigned" (Indicator: "private key"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")2a:T516,Found reference to API "FindWindowW" (Indicator: "FindWindowW"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindowExW"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindowW"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindowExW"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "4192690551,7128,100,,FindWindowExW,user32.dll,"00:21:23.546",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "9659780303,7180,100,,FindWindowExW,user32.dll,"00:21:25.812",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "8800957929,7180,100,,FindWindowExW,user32.dll,"00:21:25.468",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "9138401839,7180,100,,FindWindowExW,user32.dll,"00:21:25.609",RX=0,PX=0" (Indicator: "FindWindowExW"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp")2b:T5a6,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")2c:T619,Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API ")ExpandEnvironmentStrings" (Indicator: "ExpandEnvironmentStrings"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "ExpandEnvironmentStrings" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")2d:T96a,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "4192690551,7128,100,,FindWindowExW,user32.dll,"00:21:23.546",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "9659780303,7180,100,,FindWindowExW,user32.dll,"00:21:25.812",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "8800957929,7180,100,,FindWindowExW,user32.dll,"00:21:25.468",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "9138401839,7180,100,,FindWindowExW,user32.dll,"00:21:25.609",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp")2e:Ta68,Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "us-namespace'::CallDllGetVersion" (Indicator: "GetVersion"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetVersionEx() unexpectedly failed" (Indicator: "GetVersion"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "`anonymous-namespace'::CallDllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetVersionEx() unexpectedly failed" (Indicator: "GetVersion"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "4103485160,7128,3024,,RtlGetVersion,NTDLL.dll,"00:21:23.500",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "3575532156,4936,3024,,RtlGetVersion,NTDLL.dll,"00:21:23.281",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp")2f:T130b,"TNODUP-Portable.exe" called "NtQueryInformationToken" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenKeyEx" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryValueKey" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenFile" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtSetInformationKey" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryInformationFile" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtEnumerateKey" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryKey" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtEnumerateValueKey" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtProtectVirtualMemory" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenThread" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtResumeThread" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtAllocateVirtualMemory" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryAttributesFile" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtCreateSection" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtMapViewOfSection" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryVolumeInformationFile" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtSetInformationProcess" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LdrGetDllHandle" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LdrLoadDll" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryVirtualMemory" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryInformationProcess" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LdrUnloadDll" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtCreateKeyEx" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenSection" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtConnectPort" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtRequestWaitReplyPort" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenProcessToken" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtCreateEvent" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtNotifyChangeKey" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQuerySystemInformation" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenProcess" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenThreadToken" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtCreateThreadEx" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtDelayExecution" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryLicenseValue" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenEvent" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtOpenDirectoryObject" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "RpcStringBindingComposeW" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtAlpcConnectPortEx" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtAlpcSendWaitReceivePort" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtAlpcConnectPort" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtSetInformationThread" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtDeviceIoControlFile" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueueApcThread" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtQueryDefaultLocale" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtUnmapViewOfSection" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtSetValueKey" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "NtTerminateProcess" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "RtlGetNtProductType" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "RtlGetVersion" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "FindWindowExW" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "IsWow64Process" (PID: 7920) (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetKeyState" (PID: 7920) (UID: 00000000-00007920)30:T4f5,"TNODUP-Portable.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007920) "TNODUP-Portable.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00007920)31:T283c,"TNODUP-Portable.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter WSAAsyncSelect (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter Shell_NotifyIconW (UID: 00000000-00007920) "TNODUP-Portable.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007920)32:T430,Found reference to API "LockResource" (Indicator: "LockResource"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")33:T1a22,"SOFTWARE\ESET\NOD\CurrentVersion\Modules\Update\Settings" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000400\settings" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000400\Settings" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000400\Profiles" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\NOD\CurrentVersion\Info" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\NOD\CurrentVersion\InstalledComponents\NOD32MOD_WINNT_" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Info" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000F00" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000600\settings\EKRN_CFG" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000F00\settings" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000f00" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000600\settings\EKRN_CFG" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000f00\settings" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "Software\Policies\Microsoft\Control Panel" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "Software\Policies\Microsoft\Windows\Control Panel" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "Software\" in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin "SOFTWARE\ESET\NOD\CurrentVersion\Modules\Update\Settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000400\settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000400\Settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000400\Profiles" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\NOD\CurrentVersion\Info" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\NOD\CurrentVersion\InstalledComponents\NOD32MOD_WINNT_" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Info" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000F00" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000600\settings\EKRN_CFG" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000F00\settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000f00" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000600\settings\EKRN_CFG" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000f00\settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "Software\Policies\Microsoft\Control Panel" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "Software\Policies\Microsoft\Windows\Control Panel" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "Software\" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007920.00000000.82321.02B10000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00007920.00000000.82321.02B15000.00000004.mdmp "Y\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00007920.00000000.82321.04A30000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settingsvx" in Source: 00000000-00007920.00000000.82321.04BF8000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp34:T10ae,"SOFTWARE\ESET\NOD\CurrentVersion\Modules\Update\Settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000400\settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000400\Settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000400\Profiles" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\NOD\CurrentVersion\Info" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\NOD\CurrentVersion\InstalledComponents\NOD32MOD_WINNT_" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Info" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000F00" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000600\settings\EKRN_CFG" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000F00\settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000f00" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000600\settings\EKRN_CFG" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\ESET\ESET Security\CurrentVersion\Config\plugins\01000f00\settings" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "Software\Policies\Microsoft\Control Panel" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "Software\Policies\Microsoft\Windows\Control Panel" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "Software\" in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007920.00000000.82321.02B10000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00007920.00000000.82321.02B15000.00000004.mdmp "Y\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00007920.00000000.82321.04A30000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settingsvx" in Source: 00000000-00007920.00000000.82321.04BF8000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007920.00000000.82321.7ED40000.00000002.mdmp35:T154b,"TNODUP-Portable.exe" loaded module "C:\TNODUP-Portable.exe" at 00400000 "TNODUP-Portable.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 8D8B0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77030000 "TNODUP-Portable.exe" loaded module "%WINDIR%\System32\wow64.dll" at 6BC20000 "TNODUP-Portable.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 6BBA0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 00150000 "TNODUP-Portable.exe" loaded module "%WINDIR%\System32\user32.dll" at 02B20000 "TNODUP-Portable.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 6BB90000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 76E80000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 75A50000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\apphelp.dll" at 739A0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 760E0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 73A50000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\wininet.dll" at 734B0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 73A40000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74130000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 73C90000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 76D40000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\Wldap32.dll" at 73A70000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\winhttp.dll" at 72FB0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" at 72900000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 766B0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 73FF0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\wsock32.dll" at 72F20000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 76240000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 03090000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 73CE0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 755F0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 759D0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 73D10000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 02F70000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 760C0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\comdlg32.dll" at 76F50000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 754D0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\winspool.drv" at 720B0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 75930000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 74190000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\IPHLPAPI.DLL" at 73970000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 723B0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 73AD0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 76770000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 76DB0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 764A0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 75980000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 74110000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 73EF0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 761A0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 76E30000 "TNODUP-Portable.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72060000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 738F0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 71FD0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 732C0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\msctf.dll" at 73B20000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 728D0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\iertutil.dll" at 73080000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\NapiNSP.dll" at 71FB0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\pnrpnsp.dll" at 71F90000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\nlaapi.dll" at 71F70000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\mswsock.dll" at 72F50000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\dnsapi.dll" at 722E0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\nsi.dll" at 73C70000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\winrnr.dll" at 71F60000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\OnDemandConnRouteHelper.dll" at 73060000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\winnsi.dll" at 72F40000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\FWPUCLNT.DLL" at 72290000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SysWOW64\rasadhlp.dll" at 72F3000036:T813,"TNODUP-Portable.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75a50000 "TNODUP-Portable.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75a50000 "TNODUP-Portable.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75a50000 "TNODUP-Portable.exe" loaded module "KERNEL32" at base 76e80000 "TNODUP-Portable.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71fd0000 "TNODUP-Portable.exe" loaded module "ADVAPI32" at base 76db0000 "TNODUP-Portable.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 75a50000 "TNODUP-Portable.exe" loaded module "USER32.DLL" at base 2f70000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 732c0000 "TNODUP-Portable.exe" loaded module "WSOCK32.DLL" at base 72f20000 "TNODUP-Portable.exe" loaded module "UXTHEME.DLL" at base 732c0000 "TNODUP-Portable.exe" loaded module "SHELL32.DLL" at base 74190000 "TNODUP-Portable.exe" loaded module "KERNEL32.DLL" at base 76e80000 "TNODUP-Portable.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 764a0000 "TNODUP-Portable.exe" loaded module "RPCRT4.DLL" at base 760e0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 71fb0000 "TNODUP-Portable.exe" loaded module "SSPICLI.DLL" at base 73a50000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 71f90000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 71f70000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72f50000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 71f60000 "TNODUP-Portable.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 73060000 "TNODUP-Portable.exe" loaded module "WINHTTP.DLL" at base 72fb0000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73060000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72290000 "TNODUP-Portable.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72f3000037:Te0e,Observed system executable string:"C:\windows\temp\VxSSL32.dll" [Source: 00000000-00007920.00000000.82321.000B0000.00000020.mdmp 00000000-00007920.00000000.82321.02B00000.00000002.mdmp] Observed system executable string:"\??\C:\windows\temp\VxOle32.dll" [Source: 00000000-00007920.00000000.82321.00118000.00000004.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\ntdll.dll" [Source: 00000000-00007920.00000000.82321.00118000.00000004.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoa.dll" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\sxsoa.dll" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\GdiPlus.dll" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\GdiPlus.dll" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\comctl32.dll" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoaps.dll" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\sxsoaps.dll" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll.mui" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\comctl32.dll.mui" [Source: 00000000-00007920.00000000.82321.00120000.00000002.mdmp] Observed system executable string:"\??\C:\WINDOWS\SysWOW64\WSOCK32.dll" [Source: 00000000-00007920.00000000.82321.00198000.00000004.mdmp] Observed system executable string:"\??\C:\WINDOWS\SysWOW64\bcrypt.dll" [Source: 00000000-00007920.00000000.82321.001D8000.00000004.mdmp] Observed system executable string:"C:\windows\temp\VxOle32.dll" [Source: 00000000-00007920.00000000.82321.001E0000.00000020.mdmp 00000000-00007920.00000000.82321.049F0000.00000002.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\ntdll.dll" [Source: 00000000-00007920.00000000.82321.02B10000.00000004.mdmp 00000000-00007920.00000000.82321.02B30000.00000004.mdmp 00000000-00007920.00000000.82321.02F6D000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64.dll" [Source: 00000000-00007920.00000000.82321.02B10000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64win.dll" [Source: 00000000-00007920.00000000.82321.02B10000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64cpu.dll" [Source: 00000000-00007920.00000000.82321.02B10000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\apphelp.dll" [Source: 00000000-00007920.00000000.82321.02B30000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNEL32.DLL" [Source: 00000000-00007920.00000000.82321.02B30000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNELBASE.dll" [Source: 00000000-00007920.00000000.82321.02B30000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\RPCRT4.dll" [Source: 00000000-00007920.00000000.82321.02B30000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\SspiCli.dll" [Source: 00000000-00007920.00000000.82321.02B30000.00000004.mdmp]38:T426,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")39:T7116,"TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\PENDINGDELETE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TNODUP-PORTABLE.EXE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\031A77C3"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\0000000A"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\00000014"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PROPERTYBAG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\PROPERTYBAG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PROPERTYBAG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER\DOWNLOADLICDLG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER\DOWNLOADLICDLG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\ESET\NOD\CURRENTVERSION\INFO"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\ESET\ESET SECURITY\CURRENTVERSION\INFO"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PROPERTYBAG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PROPERTYBAG"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\RETRY_HEADERONLYPOST_ONCONNECTIONRESET"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\RETRY_HEADERONLYPOST_ONCONNECTIONRESET"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_MIME_HANDLING"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_MIME_HANDLING"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INCLUDE_PORT_IN_SPN_KB908209"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INCLUDE_PORT_IN_SPN_KB908209"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BUFFERBREAKING_818408"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BUFFERBREAKING_818408"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_USE_CNAME_FOR_SPN_KB911149"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_USE_CNAME_FOR_SPN_KB911149"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DIGEST_NO_EXTRAS_IN_URI"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DIGEST_NO_EXTRAS_IN_URI"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_SCH_SEND_AUX_RECORD_KB_2618444"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_SCH_SEND_AUX_RECORD_KB_2618444"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS\DNSCACHE"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOWNLOAD"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ENABLE_TOKEN_BINDING"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ENABLE_TOKEN_BINDING"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "")3a:T15262,"TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "TNODUP-PORTABLE.EXE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\{7746D80F-97E0-4E26-9543-26B41FC22F79}\{FB9F5B62-B48B-45F5-8586-E514958C92E2}"; Key: "92527009FFD9103BC95ED76F1D263EB76030E2E1C07BA1B520971CD841282E5C"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "TNODUP-PORTABLE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C69CB70A-3133-4CCA-AB0E-046848EFFCDA"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C9BF4A02-D547-4D11-8242-E03A18B5BE01"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "5EEC90AB-C022-44B2-A5DD-FD716A222A15"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "SECSWAITFORINTERNET"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "EXPIRATIONSERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "LINES2SKIPXML"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "SERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "SERVERPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "HIDEMODE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "NEWVERSIONS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEKEY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "UPDATETABS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "AVOIDNEAREXPIRATION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "NAMEUSERNAMEFIELD"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "NAMEPASSWORDFIELD"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "REGEXLICENSEKEYFIELD"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "URLGETLICENSEKEY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "URLPOSTLICENSEKEY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "EXTRAPARAMSLICENSEKEY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "TABSMAIN"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "TABSSECONDARYMAIN"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "TABSLICENSE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "TABSACCEPTLICENSE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "KEYUNLOCK"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "INSERTIFEXPIRENEAR"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEPROXY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEIEPROXY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "INCLUDETRIAL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PASSSERVERS2"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PASSSERVERSVERSION2"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PERSONALPASSSERVERS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "ESETSERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "ESETFILE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "ESETSERVERUPGRADE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "INSERTTYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "LANGUAGE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "LIC2CHECKINEVERYSERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "LIC2CHECKINPARALLEL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PROXYHOST"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PROXYPASSWORD"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PROXYUSERNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PROXYPORT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "ALERTTYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEOFICIALSERVERSFIRST"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEPROXYLOGIN"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: "SERIAL_ACCESS_NUM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "LIBRARYPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "DISPLAYSTRING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "PROVIDERID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "ADDRESSFAMILY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "SUPPORTEDNAMESPACE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "ENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "VERSION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "STORESSERVICECLASSINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "PROVIDERINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "LIBRARYPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "DISPLAYSTRING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "PROVIDERID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "ADDRESSFAMILY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "SUPPORTEDNAMESPACE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "ENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "VERSION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "STORESSERVICECLASSINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "PROVIDERINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "LIBRARYPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "DISPLAYSTRING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "PROVIDERID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "ADDRESSFAMILY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "SUPPORTEDNAMESPACE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "ENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "VERSION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "STORESSERVICECLASSINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "PROVIDERINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "LIBRARYPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "DISPLAYSTRING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "PROVIDERID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "ADDRESSFAMILY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "SUPPORTEDNAMESPACE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "ENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "VERSION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "STORESSERVICECLASSINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000004"; Key: "PROVIDERINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "LIBRARYPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "DISPLAYSTRING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "PROVIDERID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "ADDRESSFAMILY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "SUPPORTEDNAMESPACE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "ENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "VERSION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "STORESSERVICECLASSINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "PROVIDERINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "LIBRARYPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "DISPLAYSTRING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "PROVIDERID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "ADDRESSFAMILY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "SUPPORTEDNAMESPACE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "ENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "VERSION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "STORESSERVICECLASSINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "PROVIDERINFO"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WS2_32NUMHANDLEBUCKETS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WS2_32SPINCOUNT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "CATEGORY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "NAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "PARENTFOLDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "DESCRIPTION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "RELATIVEPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "PARSINGNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "INFOTIP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "LOCALIZEDNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "ICON"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "SECURITY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "STREAMRESOURCE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "STREAMRESOURCETYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "LOCALREDIRECTONLY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "ROAMABLE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "PRECREATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "STREAM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "DEFINITIONFLAGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "ATTRIBUTES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "FOLDERTYPEID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"; Key: "INITFOLDERHANDLER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "PROGRAMFILESDIR"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000602XX"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN-US"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "CATEGORY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "NAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "PARENTFOLDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "DESCRIPTION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "RELATIVEPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "PARSINGNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "INFOTIP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "LOCALIZEDNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "ICON"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "SECURITY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "STREAMRESOURCE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "STREAMRESOURCETYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "LOCALREDIRECTONLY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "ROAMABLE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "PRECREATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "STREAM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "DEFINITIONFLAGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "ATTRIBUTES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "FOLDERTYPEID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}"; Key: "INITFOLDERHANDLER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "CATEGORY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "NAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "PARENTFOLDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "DESCRIPTION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "RELATIVEPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "PARSINGNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "INFOTIP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "LOCALIZEDNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "ICON"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "SECURITY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "STREAMRESOURCE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "STREAMRESOURCETYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "LOCALREDIRECTONLY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "ROAMABLE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "PRECREATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "STREAM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "DEFINITIONFLAGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "ATTRIBUTES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "FOLDERTYPEID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"; Key: "INITFOLDERHANDLER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEHOSTSFILE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ADDRCONFIGCONTROL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLESMARTNAMERESOLUTION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PREFERLOCALOVERLOWERBINDINGDNS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYNETBTFQDN"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLESMARTPROTOCOLREORDERING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "UDPRECVBUFFERSIZE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLEPARALLELAANDAAAA"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLECOALESCING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERVPNTRIGGER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEMULTIHOMEDROUTECONFLICTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTRATIONENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEDYNAMICUPDATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTERPRIMARYNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTERADAPTERNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ENABLEADAPTERDOMAINNAMEREGISTRATION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTERREVERSELOOKUP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEREVERSEADDRESSREGISTRATIONS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTERWANADAPTERS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEWANDYNAMICUPDATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTRATIONTTL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DEFAULTREGISTRATIONTTL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTRATIONREFRESHINTERVAL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DEFAULTREGISTRATIONREFRESHINTERVAL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTRATIONMAXADDRESSCOUNT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "MAXNUMBEROFADDRESSESTOREGISTER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "UPDATESECURITYLEVEL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "UPDATESECURITYLEVEL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "UPDATETOPLEVELDOMAINZONES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOWNCASESPNCAUSEAPIOWNERISTOOLAZY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTRATIONOVERWRITE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "MAXCACHESIZE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "MAXCACHETTL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "MAXNEGATIVECACHETTL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ADAPTERTIMEOUTLIMIT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SERVERPRIORITYTIMELIMIT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "MAXCACHEDSOCKETS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLESERVERUNREACHABILITY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEMULTICAST"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "MULTICASTRESPONDERFLAGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "MULTICASTSENDERFLAGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "MULTICASTSENDERMAXTIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSTEST"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USECOMPARTMENTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "CACHEALLCOMPARTMENTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USENEWREGISTRATION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "RESOLVERREGISTRATION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "RESOLVERREGISTRATIONONLY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "NEWDHCPSRVREGISTRATION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSPREFERLOCAL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLEIDNENCODING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEIDNMAPPING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SHORTNAMEPROXYDEFAULT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "TESTMODE_ADAPTIVETIMEOUTHISTORYLENGTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "TESTMODE_ADAPTIVETIMEOUTRECALCULATIONINTERVAL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSQUERYTIMEOUTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DNSQUERYTIMEOUTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSQUICKQUERYTIMEOUTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DNSQUICKQUERYTIMEOUTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SYNCMODE5"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SESSIONSTARTTIMEDEFAULTDELTASECS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "CATEGORY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "NAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PARENTFOLDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "DESCRIPTION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "RELATIVEPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PARSINGNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "INFOTIP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "LOCALIZEDNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "ICON"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "SECURITY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAMRESOURCE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAMRESOURCETYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "LOCALREDIRECTONLY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "ROAMABLE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PRECREATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "DEFINITIONFLAGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "ATTRIBUTES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "FOLDERTYPEID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "INITFOLDERHANDLER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "CACHE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: "DEFAULT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "CATEGORY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "NAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "PARENTFOLDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "DESCRIPTION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "RELATIVEPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "PARSINGNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "INFOTIP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "LOCALIZEDNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "ICON"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "SECURITY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "STREAMRESOURCE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "STREAMRESOURCETYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "LOCALREDIRECTONLY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "ROAMABLE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "PRECREATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "STREAM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "DEFINITIONFLAGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "ATTRIBUTES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "FOLDERTYPEID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "INITFOLDERHANDLER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "LOCAL APPDATA"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MBCSAPIFORCRACK"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECURITY_HKLM_ONLY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE"; Key: "TNODUP-PORTABLE.EXE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE"; Key: "*"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL"; Key: "FEATURE_CLIENTAUTHCERTFILTER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL"; Key: "FEATURE_CLIENTAUTHCERTFILTER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_MIME_HANDLING"; Key: "TNODUP-PORTABLE.EXE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_MIME_HANDLING"; Key: "*"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK"; Key: "TNODUP-PORTABLE.EXE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK"; Key: "*"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEZLIBDEFLATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "FROMCACHETIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECUREPROTOCOLS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECUREPROTOCOLS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECUREPROTOCOLS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CERTIFICATEREVOCATION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CERTIFICATEREVOCATION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLEKEEPALIVE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "IDNENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PRECONNECTLIMIT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PRERESOLVELIMIT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CACHEMODE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEHTTP1_1"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEHTTP1_1"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEHTTP1_1"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYHTTP1.1"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYHTTP1.1"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYHTTP1.1"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLENEGOTIATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLEBASICOVERCLEARCHANNEL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEAUTOPROXYRESULTCACHE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISPLAYSCRIPTDOWNLOADFAILUREUI"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MBCSSERVERNAME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "UTF8SERVERNAMERES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLEREADRANGE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SOCKETSENDBUFFERLENGTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SOCKETRECEIVEBUFFERLENGTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "KEEPALIVETIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MAXHTTPREDIRECTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MAXCONNECTIONSPERSERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MAXCONNECTIONSPERSERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MAXCONNECTIONSPER1_0SERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MAXCONNECTIONSPER1_0SERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MAXCONNECTIONSPERPROXY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MAXCONNECTIONSPERPROXY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SERVERINFOTIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CONNECTTIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CONNECTTIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CONNECTRETRIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CONNECTRETRIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SENDTIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SENDTIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "RECEIVETIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "RECEIVETIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLENTLMPREAUTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CERTCACHENOVALIDATE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "HTTPDEFAULTEXPIRYTIMESECS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "FTPDEFAULTEXPIRYTIMESECS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "LEASHLEGACYCOOKIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DIALUPUSELANSETTINGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DIALUPUSELANSETTINGS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SENDEXTRACRLF"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEHTTPTRACE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "NOCHECKAUTODIALOVERRIDE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "NOCHECKAUTODIALOVERRIDE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DONTUSEDNSLOADBALANCING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DONTUSEDNSLOADBALANCING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SHARECREDSWITHWINHTTP"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MIMEEXCLUSIONLISTFORCACHE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "HEADEREXCLUSIONLISTFORCACHE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOWNLOAD"; Key: "FEATUREENABLETOKENBINDINGOVERRIDE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DNSCACHEENABLED"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DNSCACHEENTRIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DNSCACHETIMEOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WARNONPOST"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WARNALWAYSONPOST"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WARNONZONECROSSING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WARNONBADCERTRECVING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WARNONPOSTREDIRECT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ALWAYSDRAINONREDIRECT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WARNONHTTPSTOHTTPREDIRECT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "TCPAUTOTUNING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSETTINGSPERUSER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CALLLEGACYWCMPOLICIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOPROXYQUERYWITHFULLURL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLELEGACYAUTOPROXYFEATURES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BADPROXYEXPIRESTIME"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOPROXYDETECTTYPE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLEBRANCHCACHE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "FRAMETABWINDOW"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "FRAMETABWINDOW"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "FRAMEMERGING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "FRAMEMERGING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "SESSIONMERGING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "SESSIONMERGING"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "ADMINTABPROCS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "ADMINTABPROCS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "RUNBINARYCONTROLHOSTPROCESSINSEPARATEAPPCONTAINER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "RUNBINARYCONTROLHOSTPROCESSINSEPARATEAPPCONTAINER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "TABPROCGROWTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "TABPROCGROWTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "TABPROCGROWTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "USEFIRSTAVAILABLE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "COMBINEFALSESTARTDATA"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLEFALSESTARTBLOCKLIST"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEHTTP2UPGRADE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DUOPROTOCOLS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLESPDYDEBUGASSERTS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLETCPFASTOPEN"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "EDPENFORCEMENTOVERRIDE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MIGRATEPROXY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOCONFIGURL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTODETECT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DIALUPAUTODETECT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DEFAULTSECUREPROTOCOLS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DISABLEBRANCHCACHE"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DISABLEAUTOPROXYAUTH"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "ENABLEDEFAULTHTTP2"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "AUTOPROXYQUERYWITHFULLURL"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "")3b:T30b4,"TNODUP-Portable.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "TNODUP-Portable.exe" trying to touch file "C:\TNODUP-Portable.exe" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "TNODUP-Portable.exe" trying to touch file "C:\TNODUP-PORTABLE.EXE.LOCAL" "TNODUP-Portable.exe" trying to touch file "C:\WININET.DLL" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\wininet.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINHTTP.DLL" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\winhttp.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "TNODUP-Portable.exe" trying to touch file "C:\WSOCK32.DLL" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\wsock32.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINSPOOL.DRV" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\winspool.drv" "TNODUP-Portable.exe" trying to touch file "C:\IPHLPAPI.DLL" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\IPHLPAPI.DLL" "TNODUP-Portable.exe" trying to touch file "C:\BCRYPT.DLL" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\bcrypt.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\bcryptprimitives.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\cryptbase.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\sspicli.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\rpcrt4.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\combase.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\ws2_32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\Wldap32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\SHCore.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\shlwapi.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\cfgmgr32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\advapi32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\kernel.appcore.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\powrprof.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\profapi.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\windows.storage.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\shell32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\comdlg32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\ole32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "TNODUP-Portable.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "TNODUP-Portable.exe" trying to touch file "C:\FLTLIB.DLL" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "TNODUP-Portable.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "TNODUP-Portable.exe" trying to touch file "C:\TNODUP-PORTABLE.INI" "TNODUP-Portable.exe" trying to touch file "C:\TNODUP-Portable.ini" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\msctf.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\dwmapi.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\system32\dwmapi.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\RPCSS.DLL" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "TNODUP-Portable.exe" trying to touch file "C:\IERTUTIL.DLL" "TNODUP-Portable.exe" trying to touch file "C:\iertutil.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\iertutil.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\SYSTEM32\iertutil.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\NapiNSP.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\system32\napinsp.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\pnrpnsp.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\system32\pnrpnsp.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\nlaapi.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\system32\NLAapi.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\mswsock.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\System32\mswsock.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\dnsapi.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\SYSTEM32\DNSAPI.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\nsi.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\winrnr.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\System32\winrnr.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\OnDemandConnRouteHelper.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ondemandconnroutehelper.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\winnsi.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\SYSTEM32\WINNSI.DLL" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\FWPUCLNT.DLL" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\System32\fwpuclnt.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\rasadhlp.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\System32\rasadhlp.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\tzres.dll" "TNODUP-Portable.exe" trying to touch file "C:\WINDOWS\SYSTEM32\tzres.dll" "TNODUP-Portable.exe" trying to touch file "C:\Windows\SysWOW64\en-US\tzres.dll.mui" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\System32\WOW64LOG.DLL" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\ntdll.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\kernel32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\apppatch\sysmain.sdb" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\apphelp.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\msvcrt.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\wininet.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\ucrtbase.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\bcryptprimitives.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\cryptbase.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\sspicli.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\rpcrt4.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\sechost.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\winhttp.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\combase.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\msvcp_win.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\win32u.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\user32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32full.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\ws2_32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\wsock32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\Wldap32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\IPHLPAPI.DLL" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\bcrypt.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\winspool.drv" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\SHCore.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\shlwapi.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\cfgmgr32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\advapi32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\kernel.appcore.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\powrprof.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\profapi.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\windows.storage.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\shell32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\comdlg32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\imm32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\WindowsShell.Manifest" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\oleaut32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\ole32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\fltLib.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\Temp\VxSSL32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\Temp\VxOle32.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\uxtheme.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\msctf.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\dwmapi.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\KernelBase.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\RPCSS.DLL" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\iertutil.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\NapiNSP.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\pnrpnsp.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\nlaapi.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\mswsock.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\nsi.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\dnsapi.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\winrnr.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\OnDemandConnRouteHelper.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\winnsi.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\FWPUCLNT.DLL" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\rasadhlp.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\tzres.dll" "TNODUP-Portable.exe" trying to touch file "%WINDIR%\SysWOW64\en-US\tzres.dll.mui"3c:T422,Found string "--%sContent-Disposition: form-data; name="%s"%s"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "--%sContent-Disposition: form-data; name="%s"; filename="%s"Content-Type: %s"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Content-Type: multipart/form-data"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Content-Disposition: form-data; name=""; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp"), Found string "Content-Disposition: form-data; name="%s""; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp"), Found string "Content-Disposition: form-data; name="%s"; filename="%s""; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp"), Found string "Content-Type: multipart/form-data"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp"), Found string "Content-Disposition: form-data; name=""; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")3d:T5f4,Found string "D:\opensource\openssl-dist-1.0.1t-vs2015\openssl-x86-static-release-vs2015/ssl" (Indicator: "openssl-"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "D:\opensource\openssl-dist-1.0.1t-vs2015\openssl-x86-static-release-vs2015/ssl/certs" (Indicator: "openssl-"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "D:\opensource\openssl-dist-1.0.1t-vs2015\openssl-x86-static-release-vs2015/ssl/cert.pem" (Indicator: "openssl-"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "D:\opensource\openssl-dist-1.0.1t-vs2015\openssl-x86-static-release-vs2015/lib/engines" (Indicator: "openssl-"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "D:\opensource\openssl-dist-1.0.1t-vs2015\openssl-x86-static-release-vs2015/ssl" (Indicator: "openssl-"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "D:\opensource\openssl-dist-1.0.1t-vs2015\openssl-x86-static-release-vs2015/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "D:\opensource\openssl-dist-1.0.1t-vs2015\openssl-x86-static-release-vs2015/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "D:\opensource\openssl-dist-1.0.1t-vs2015\openssl-x86-static-release-vs2015/lib/engines" (Indicator: "openssl-"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")3e:T6bb,Found reference to API "French: Pierre Duchemin " (Indicator: "@gmail."; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "Swedish: MrCyberNeo " (Indicator: "@hotmail."; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "Turkish: Progressive " (Indicator: "@gmail."; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "Tukero " (Indicator: "@gmail."; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "" (Indicator: "@gmail."; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "o " (Indicator: "@hotmail."; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "kero " (Indicator: "@gmail."; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "French: Pierre Duchemin " (Indicator: "@gmail."; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Swedish: MrCyberNeo " (Indicator: "@hotmail."; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Turkish: Progressive " (Indicator: "@gmail."; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Tukero " (Indicator: "@gmail."; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")3f:T6f4,Found string "%s %s%s HTTP/1.0" (Indicator: "HTTP/1.0"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "%s %s HTTP/1.0" (Indicator: "HTTP/1.0"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "%s%s HTTP/1.0" (Indicator: "HTTP/1.0"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive!" (Indicator: "HTTP/1.0"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "HTTP/1.1 proxy connection set close!" (Indicator: "HTTP/1.1"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "HTTP/1.0 connection set to keep alive!" (Indicator: "HTTP/1.0"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "%s %s%s HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "%s %s HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive!" (Indicator: "HTTP/1.0"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "HTTP/1.1 proxy connection set close!" (Indicator: "HTTP/1.1"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "HTTP/1.0 connection set to keep alive!" (Indicator: "HTTP/1.0"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ET /ip_locate_iso2 HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found string "GET /ip_locate_iso2 HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp")40:T86f,Observed string: "?Stack part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "Big Number part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "ASN.1 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "SHA-256 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "MD5 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "DES part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "libdes part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "MD4 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "RSA part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "Diffie-Hellman part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "DSA part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "PEM part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "RAND part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "CONF part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "lhash part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "X.509 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "SHA1 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "SHA-512 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "EC part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "EVP part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "CONF_def part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "ECDSA part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "IDEA part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "RC2 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.")41:Ta2d,"TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\windows\\temp\\VxOle32.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernelbase.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\TNODUP-Portable.ini" "$status": "c0000034"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\uxtheme.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\dwmapi.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\rpcss.dll" "$status": "c0000034"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\iertutil.dll" "$status": "c0000034"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\iertutil.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\napinsp.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\pnrpnsp.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\NLAapi.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\System32\\mswsock.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\DNSAPI.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\System32\\winrnr.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\ondemandconnroutehelper.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\WINNSI.DLL"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\System32\\fwpuclnt.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\System32\\rasadhlp.dll"} "TNODUP-Portable.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\tzres.dll"}42:Tf44,"TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "8562576672526697092" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "668" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "684" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "692" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "708" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "744" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "996432413428" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "371255650216313668" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "916" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "932" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "936" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "928" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "1040" "DesiredAccess": "8" "TokenHandle": "371259515686880276" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "371258192836953108" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "1044" "DesiredAccess": "8" "TokenHandle": "5919564445516816" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "1040" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "371258106937607192" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "371259515686880280" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "1076" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "371256217151996988" "$name": "C:\\TNODUP-Portable.exe"} "TNODUP-Portable.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "33554432" "TokenHandle": "1200" "$name": "C:\\TNODUP-Portable.exe"}43:Tb87,"TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "45541307766013952" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "8388023626749706240" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "195906583790616576" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131080" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131080" "OpenAsSelf": "1" "TokenHandle": "73014444032" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "1" "TokenHandle": "996432412672" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131086" "OpenAsSelf": "1" "TokenHandle": "371255478417620992" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131086" "OpenAsSelf": "1" "TokenHandle": "371253073235935232" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "8537822894804172800" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "195343633837195264" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "14" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "14" "OpenAsSelf": "1" "TokenHandle": "-12884901888" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "14" "OpenAsSelf": "1" "TokenHandle": "196381469734600704" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "371254224287170560" "$status": "c000007c"} "TNODUP-Portable.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "131080" "OpenAsSelf": "1" "TokenHandle": "7163378105329909760" "$status": "c000007c"}44:Td78,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "GetDIBits()" (Indicator: "GetDIBits"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "CreateCompatibleDC(NULL)" (Indicator: "CreateCompatibleDC"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "GdipGetDC" (Indicator: "GetDC"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "CreateDC(printer)" (Indicator: "CreateDC"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetDIBits()" (Indicator: "GetDIBits"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CreateCompatibleDC(NULL)" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GdipGetDC" (Indicator: "GetDC"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CreateDC(printer)" (Indicator: "CreateDC"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp")45:T798,Found reference to API "wxFindFirstFile" (Indicator: "FindFirstFile"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "You must call wxFindFirstFile before!" (Indicator: "FindFirstFile"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "wxFindNextFile" (Indicator: "FindNextFile"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "wxFindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "You must call wxFindFirstFile before!" (Indicator: "FindFirstFile"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "wxFindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")46:Tda7,Found reference to API "Process32First" (Indicator: "Process32First"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")47:T42a,Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")48:T9a6,Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")49:T435,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "4103485160,7128,3024,,RtlGetVersion,NTDLL.dll,"00:21:23.500",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "4513194685,8100,3025,,RtlGetNtProductType,NTDLL.dll,"00:21:23.671",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "3987343125,7932,3025,,RtlGetNtProductType,NTDLL.dll,"00:21:23.453",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "3575532156,4936,3024,,RtlGetVersion,NTDLL.dll,"00:21:23.281",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp")4a:T8cf,Found reference to API "wxGetKeyState" (Indicator: "GetKeyState"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "can't use wxGetKeyState() for mouse buttons" (Indicator: "GetKeyState"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "can't use wxGetKeyState() for mouse buttons" (Indicator: "GetKeyState"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "wxGetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "4431874947,1972,104,,GetKeyState,user32.dll,"00:21:23.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "4578181515,1972,104,,GetKeyState,user32.dll,"00:21:23.703",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp") Found reference to API "4518599569,1972,104,,GetKeyState,user32.dll,"00:21:23.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007920.00000000.82321.02B30000.00000004.mdmp")4b:T5b8,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")4c:T10ae,Found string "Run at windows startup%Use password to unlock NOD32 settingsBEnter the password used to allow you to modify the NOD32 settings:" (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Confirm password:#Detect proxy from Internet Explorer%Insert a different license every time" (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") file/memory contains long string with (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "YERROR: Could not insert the license because the NOD32 settings are protected by password.SERROR: Could not insert the license because administrator privilegies are required.LERROR: Could not insert the license because its 'License Key' was not found." (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Parti all'avvio di Windows6Usa la password per sbloccare le impostazioni di NOD32LInserisci la password per permettere di modificare le impostazioni di NOD32:" (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Conferma password:!Rileva proxy da Internet Explorer'Inserisci sempre una licenza differente(Inserisci sempre la prima licenza valida2Non inserire se la licenza attuale" (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Le password non coincidono." (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Copia username e password" (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Copia password" (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Se le impostazioni di NOD32 sono protette con password, con questa opzioneDevi inserire la password e la licenza verr" (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "password" (Indicator: "password"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)" (Indicator: "password"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "secretary" (Indicator: "secret"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "password based MAC" (Indicator: "password"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "secretBag" (Indicator: "secret"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0" (Indicator: "secret"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0" (Indicator: "secret"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0" (Indicator: "secret"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "ssl3_generate_master_secret" (Indicator: "secret"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "mac_secret_length <= sizeof(hmac_pad)" (Indicator: "secret"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "master secret" (Indicator: "secret"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "bad password read" (Indicator: "password"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "problems getting password" (Indicator: "password"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "no password" (Indicator: "password"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "CMS_add0_recipient_password" (Indicator: "password"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")4d:T487,Found string "format specifier doesn't match argument type" (Indicator: "format "; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found string "Format string "%s" uses both positional parameters and '*' but this is not currently supported by this implementation, sorry." (Indicator: "format "; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "format == wxIPC_TEXT || format == wxIPC_UTF8TEXT || format == wxIPC_UNICODETEXT" (Indicator: "format "; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "format error in certificate's notBefore field" (Indicator: "format "; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "format error in certificate's notAfter field" (Indicator: "format "; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "format error in CRL's lastUpdate field" (Indicator: "format "; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "format error in CRL's nextUpdate field" (Indicator: "format "; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")4e:T5ca,Found reference to API "SetWindowsHookEx(wxKeyboardHook)" (Indicator: "SetWindowsHook"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "SetWindowsHookEx(WH_GETMESSAGE)" (Indicator: "SetWindowsHook"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SetWindowsHookEx(wxKeyboardHook)" (Indicator: "SetWindowsHook"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SetWindowsHookEx(WH_GETMESSAGE)" (Indicator: "SetWindowsHook"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")4f:T55b,Found reference to API "SystemParametersInfo(GETWHEELSCROLLLINES)" (Indicator: "SystemParametersInfo"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "SystemParametersInfo(SPI_GETNONCLIENTMETRICS)" (Indicator: "SystemParametersInfo"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "SystemParametersInfo(SPI_GETICONTITLELOGFONT" (Indicator: "SystemParametersInfo"; File: "d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SystemParametersInfo(GETWHEELSCROLLLINES)" (Indicator: "SystemParametersInfo"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SystemParametersInfo(SPI_GETNONCLIENTMETRICS)" (Indicator: "SystemParametersInfo"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SystemParametersInfo(SPI_GETICONTITLELOGFONT" (Indicator: "SystemParametersInfo"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")50:Ta32,"TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "TNODUP-Portable.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")51:T556,Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "bad hostname lookup" (Indicator: "hostname"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "no hostname specified" (Indicator: "hostname"; File: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "bad hostname lookup" (Indicator: "hostname"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp") Found string "no hostname specified" (Indicator: "hostname"; Source: "00000000-00007920.00000000.82321.00778000.00000002.mdmp")52:T1b91,"TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "SECSWAITFORINTERNET"; Value: "64000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "EXPIRATIONSERVER"; Value: "http://expire.eset.com/getlicexp") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "LINES2SKIPXML"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "HIDEMODE"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "NEWVERSIONS"; Value: "01000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "AVOIDNEAREXPIRATION"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEKEY"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "KEYUNLOCK"; Value: "0000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "INSERTIFEXPIRENEAR"; Value: "01000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEPROXY"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEIEPROXY"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "INCLUDETRIAL"; Value: "01000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "NAMEUSERNAMEFIELD"; Value: "ctl00$body$txtUsername") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "NAMEPASSWORDFIELD"; Value: "ctl00$body$txtPassword") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "REGEXLICENSEKEYFIELD"; Value: "3100F7003C005B005E003E005D002B00690064003D00220062006F00640079005F006C0062006C004C006900630065006E00730065004B006500790022005B005E003E005D002A003E0028005B005E003C005D002B0029000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "URLGETLICENSEKEY"; Value: "https://my.eset.com/convert?culture=en-us") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "URLPOSTLICENSEKEY"; Value: "https://my.eset.com/convert?culture=en-us") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "EXTRAPARAMSLICENSEKEY"; Value: "&ctl00%24Login%24rblLanguage=en-US&ctl00%24body%24btnConvert=Convert") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "TABSMAIN"; Value: "08000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "TABSSECONDARYMAIN"; Value: "0B000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "TABSLICENSE"; Value: "02000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "TABSACCEPTLICENSE"; Value: "03000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PASSSERVERS2"; Value: "http://tnoduse2.blogspot.com/feeds/posts/default?alt=rss;http://www.none-ip.info/browse.php?u=Oi8vd3d3LjMybm9kLWtleS5ydS9mZWVkcy9wb3N0cy9kZWZhdWx0P2FsdD1yc3M%3D&b=5&f=norefer;http://www.none-ip.info/browse.php?u=Oi8va2V5bm9kLmJsb2dza3kuY29tL3Jzcw%3D%3D&b=5&f=norefer;http://www.none-ip.info/browse.php?u=Oi8vd3d3LmlrYXRlYy50ay9mZWVkcy9wb3N0cy9kZWZhdWx0P2FsdD1yc3M%3D&b=5&f=norefer;http://www.none-ip.info/browse.php?u=Oi8vbGljZW5jaWFzcGFyYWVzZXRub2QzMi5ibG9nc3BvdC5jb20vZmVlZHMvcG9zdHMvZGVmYXVsdD9hbHQ9cnNz&b=5&f=norefer;http://www.none-ip.info/browse.php?u=Oi8vbm9kMzJuZXcucGVyc2lhbmJsb2cuaXIvcnNzLnhtbA%3D%3D&b=5&f=norefer;http://www.none-ip.info/browse.php?u=Oi8vd3d3LmhodXUubmV0Lw%3D%3D&b=5&f=norefer;") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PASSSERVERSVERSION2"; Value: "1.229") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PERSONALPASSSERVERS"; Value: "0000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "ESETSERVER"; Value: "um11.eset.com") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "ESETFILE"; Value: "/download/engine3ess/em010_32_l0.nup") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "ESETSERVERUPGRADE"; Value: "01000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "INSERTTYPE"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "LANGUAGE"; Value: "B2000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "LIC2CHECKINEVERYSERVER"; Value: "19000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "LIC2CHECKINPARALLEL"; Value: "05000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PROXYHOST"; Value: "0000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PROXYPASSWORD"; Value: "0000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PROXYUSERNAME"; Value: "0000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "PROXYPORT"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "ALERTTYPE"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEOFICIALSERVERSFIRST"; Value: "00000000") "TNODUP-Portable.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TUKERO[X]TEAM\TNOD USER & PASSWORD FINDER"; Key: "USEPROXYLOGIN"; Value: "00000000")53:T808,Found string "RtlGetVersion" (Source: TNODUP-Portable.exe.bin, API is part of module: NTDLL.DLL) Found string "IsWow64Process" (Source: TNODUP-Portable.exe.bin, API is part of module: KERNELBASE.DLL) Found string "WSAAsyncSelect" (Source: TNODUP-Portable.exe.bin, API is part of module: WS2_32.DLL) Found string "AnimateWindow" (Source: TNODUP-Portable.exe.bin, API is part of module: USER32.DLL) Found string "GetComboBoxInfo" (Source: TNODUP-Portable.exe.bin, API is part of module: USER32.DLL) Found string "SHAutoComplete" (Source: TNODUP-Portable.exe.bin, API is part of module: SHLWAPI.DLL) Found string "GetProcessUserModeExceptionPolicy" (Source: TNODUP-Portable.exe.bin, API is part of module: KERNEL32.DLL) Found string "SetProcessUserModeExceptionPolicy" (Source: TNODUP-Portable.exe.bin, API is part of module: KERNEL32.DLL) Found string "AttachConsole" (Source: TNODUP-Portable.exe.bin, API is part of module: KERNEL32.DLL) Found string "SetGraphicsMode" (Source: TNODUP-Portable.exe.bin, API is part of module: GDI32.DLL) Found string "SetWorldTransform" (Source: TNODUP-Portable.exe.bin, API is part of module: GDI32.DLL) Found string "GetWorldTransform" (Source: TNODUP-Portable.exe.bin, API is part of module: GDI32.DLL) Found string "ModifyWorldTransform" (Source: TNODUP-Portable.exe.bin, API is part of module: GDI32.DLL) Found string "GetLayout" (Source: TNODUP-Portable.exe.bin, API is part of module: GDI32.DLL) Found string "SetLayout" (Source: TNODUP-Portable.exe.bin, API is part of module: GDI32.DLL) Found string "MonitorFromPoint" (Source: TNODUP-Portable.exe.bin, API is part of module: USER32.DLL) Found string "MonitorFromWindow" (Source: TNODUP-Portable.exe.bin, API is part of module: USER32.DLL) Found string "EnumDisplayMonitors" (Source: TNODUP-Portable.exe.bin, API is part of module: USER32.DLL) Found string "TaskDialogIndirect" (Source: TNODUP-Portable.exe.bin, API is part of module: COMCTL32.DLL) Found string "FlashWindowEx" (Source: TNODUP-Portable.exe.bin, API is part of module: USER32.DLL)54:T532,Found malicious artifacts related to "91.228.167.125": ... URL: http://expire.eset.com/ (AV positives: 1/53 scanned on 07/02/2014 10:48:19) File SHA256: 92fa98902a2fb35e6cc4825c825dee7eea4f0aa51f404ded597dc6dcda6835ac (Date: 03/13/2018 22:47:35) File SHA256: 10d5a3262a522b47f541bf24a3c99ff98ebdcd1f82c151bbdebac2426b337e25 (Date: 02/05/2018 18:38:56) File SHA256: f429d8f433cd4844d714083ef583217e3902bea8f6b83c2d1f7c816d68b7aaef (AV positives: 2/65 scanned on 02/02/2018 20:20:08) File SHA256: e33d8af6be89f087c057a7713ff9292719c2b76ab579e77e6fdec81215668a58 (AV positives: 1/66 scanned on 02/02/2018 01:14:19) File SHA256: 0146ef715f693048c1ffab3f5620426ad671bc513709f767f800d1380acc241b (AV positives: 1/67 scanned on 01/29/2018 01:42:58) File SHA256: 529cc0974e174cff6a602e533411232802bd00d5bf099e0a4ae4203393911ad8 (AV positives: 1/66 scanned on 01/27/2018 11:55:37) File SHA256: 60f52e88b54e1bc6daf371df32193bc2a90a2274f333032ea44d44c8185c9e97 (Date: 01/22/2018 04:01:38) File SHA256: e70005ed2f14ad1ed1b473dbfc5ad1a598fb7b5d83fb6eefb5c7ad08fc7ee8ea (AV positives: 1/66 scanned on 01/20/2018 19:51:23) File SHA256: bdb782c98e25ba39b660ca73ec17bae2b2e5ccee584201e73d0d92bb6e93b669 (Date: 12/31/2017 16:28:28) File SHA256: a429bbbee8347bc9bab4be3404476d62ac034e639ee0ea268bc90cce6364e618 (Date: 12/08/2017 19:42:09)55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ah3d3d3d3d3d3d3cAAAAAAId3d3d3d3d3d3d3dwAAAACHd3d3d3d3d3d3eHd3AAAAh3d3d3d3eIiIh3eId3AAAIeIiIh3iP////iIeIh3AACHiIiHiP///////4eIh3AAiIiIiI/////////4iIh3AIiIiI////d3d3j//4iIhwCIiIj///cAAAAAf//4iIdwiIiI//9wAAAAAAD//4iIcIiIj//3AAB3dwAAD//4iHeIiI//cAAHd3dwAAf/+IiHiIj//wAHj4d3j3AAj/+Ih4iI//gACIeP/3jwAH//iIeIiP/3AAAAf/8AAAB//4iHiIj/9wAAeP//9wAAf/+IiIiI//cAB/////+AAH//iIiIiP/3AH/3D/cI+AB//4iIiIj/+AD4AH/4AH9wf/+IiIiI//8A+Hj///d/cP//iIiIiI//cI///////wf/+IiIiIiP//cHiIiIiIAP//iIiAiIiP//cAAAAAAH//+IiIgIiIj///cAAAAAf//4iIiHAIiIj///+Hd3j///+IiIhwCIiIj/////////+IiIiIcACIiHiP///////4h4iIiHAACIh3eI/////4h3iIiIhwAACIh3d4iIiIh3d3d3d3cAAACIiHd3d3d3d3d3d3d3AAAAAIiId3d3d3d3d3d3dwAAAAAAiIiIiIiIiIiIiIgAAAP/AAAA/wAAAD8AAAAfAAAADwAAAAcAAAADAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAIAAAADAAAAAwAAAAOAAAADwAAAA+AAAAPwAAAD/AAAA/8AAAA==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790553207717,"unified_at":"2026-09-27T23:53:27.717Z","metadata":{"hashes":{"sha256":"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa","sha1":"720174a810703885798d4c77d5f67fb3edc700a3","md5":"81b07c3f21a008509f40a48fbc27ff83","sha512":"2133823aabfdbadf9e5e489b7a5a07f721935cf35171f376a933dd7a922ce13c8b01ccbf54e9ed67c0dea6344b5c6917389002e743e075e369a57d92bf03a9f3","ssdeep":"98304:pA0a+NU8uQL1Mf55HATw30zFAFzofw/8:pA0a+xnMPG6m6","ssdeep_chunks":["98304:pA0a+NU","98304:A0a+NU8","98304:0a+NU8u","98304:a+NU8uQ","98304:+NU8uQL","98304:NU8uQL1","98304:U8uQL1M","98304:8uQL1Mf","98304:uQL1Mf5","98304:QL1Mf55","98304:L1Mf55H","98304:1Mf55HA","98304:Mf55HAT","98304:f55HATw","98304:55HATw3","98304:5HATw30","98304:HATw30z","98304:ATw30zF","98304:Tw30zFA","98304:w30zFAF","98304:30zFAFz","98304:0zFAFzo","98304:zFAFzof","98304:FAFzofw","98304:AFzofw/","98304:Fzofw/8","196608:pA0a+NU","196608:A0a+NU8","196608:0a+NU8u","196608:a+NU8uQ","196608:+NU8uQL","196608:NU8uQL1","196608:U8uQL1M","196608:8uQL1Mf","196608:uQL1Mf5","196608:QL1Mf55","196608:L1Mf55H","196608:1Mf55HA","196608:Mf55HAT","196608:f55HATw","196608:55HATw3","196608:5HATw30","196608:HATw30z","196608:ATw30zF","196608:Tw30zFA","196608:w30zFAF","196608:30zFAFz","196608:0zFAFzo","196608:zFAFzof","196608:FAFzofw","196608:AFzofw/","196608:Fzofw/8","98304:pA0a+xn","98304:A0a+xnM","98304:0a+xnMP","98304:a+xnMPG","98304:+xnMPG6","98304:xnMPG6m","98304:nMPG6m6"],"imphash":"713c27a4d363acb61fb71e47bdf4353e"},"file_info":{"file_name":"TNODUP-Portable.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5101056,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520083246000,"last_seen":1722545155000,"last_multi_scan":1722545155000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["adload","adware","hackav","refresh","scrinject","zdengo","pua"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":166,"suspicious_count":21,"malicious_count":6,"total":193},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"},{"type":"suspicious","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Calls an API typically used to unmap view of a section from a process"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"},{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"},{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver (HTTPS)"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 36168-15647-005CF340\n GetSystemTimeAsFileTime@KERNEL32.dll at 36168-16182-005CF2B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 36168-10874-006895CA\n GetTimeZoneInformation@KERNEL32.dll at 36168-11439-00738C74","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 36168-16701-005876D0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.dll at 36168-15455-00692211\n GetUserDefaultLCID@KERNEL32.dll at 36168-15476-00698E91\n EnumSystemLocalesW@KERNEL32.dll at 36168-15461-00691B95\n EnumSystemLocalesW@KERNEL32.dll at 36168-15477-006987D1\n EnumSystemLocalesW@KERNEL32.dll at 36168-15478-006988B7\n EnumSystemLocalesW@KERNEL32.dll at 36168-15481-0069881C\n GetUserDefaultLCID@KERNEL32.dll at 36168-15548-005E1D60","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 006896F6h\" at 36168-10874-006895CA\n Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, ecx\" and \"je 00738BF7h\" at 36168-11439-00738C74\n Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp eax, 05h\" and \"jnbe 0058773Dh\" at 36168-16701-005876D0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"TNODUP-Portable.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.dll at 36168-15319-005CE970","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"TNODUP-Portable.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"TNODUP-Portable.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\duser.dll.mui\"\n \"TNODUP-Portable.exe\" touched file \"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\"\n \"TNODUP-Portable.exe\" touched file \"%WINDIR%\\SysWOW64\\imageres.dll\"\n \"TNODUP-Portable.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\imageres.dll.mui\"\n \"TNODUP-Portable.exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"TNODUP-Portable.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$22","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"TNODUP-Portable.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"NOD32 tap\" (Indicator: \"nod32\")\n \"NOD32 alg\" (Indicator: \"nod32\")\n \"cia NOD32.\" (Indicator: \"nod32\")\n \"NOD32 pou\" (Indicator: \"nod32\")\n \"NOD32 chr\" (Indicator: \"nod32\")\n \"NOD32.\" (Indicator: \"nod32\")\n \": NOD32\" (Indicator: \"nod32\")\n \"NOD32,\" (Indicator: \"nod32\")\n \"NOD32\" (Indicator: \"nod32\")\n \"Nod32\" (Indicator: \"nod32\")\n \"nod32\" (Indicator: \"nod32\")\n \"NOD32<\" (Indicator: \"nod32\")","origin":"File/Memory","mitre_attack_id":"T1063","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$23","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/70 reputation engines marked \"http://www.tukero.org/\" as malicious (1% detection rate)\n 1/70 reputation engines marked \"http://www.tukero.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.dll at 36168-16183-005CECC0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"TNODUP-Portable.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 10844928)\n \"TNODUP-Portable.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 10844928)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n \"1.2.0.4\"\n Heuristic match: \"127.0.0.1/\"\n Heuristic match: \"Invalid file://hostname/, expected localhost or 127.0.0.1 or none\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n GetUserNameW\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n GetDriveTypeW\n TerminateProcess\n FindNextFileA\n GetFileAttributesW\n UnhandledExceptionFilter\n GetTempPathW\n CopyFileW\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExW\n CreateThread\n GetModuleHandleExW\n SleepEx\n LoadLibraryW\n GetVersionExW\n GetTickCount\n ExitThread\n GetStartupInfoW\n DeleteFileW\n GetTempFileNameW\n GetComputerNameW\n WriteFile\n FindFirstFileExA\n FindNextFileW\n FindFirstFileW\n GetProcAddress\n CreateFileW\n LockResource\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n FindResourceW\n Sleep\n ShellExecuteW\n ShellExecuteExW\n GetCursorPos\n GetUpdateRgn\n FindWindowW\n SetWindowsHookExW\n FindWindowExW\n InternetGetConnectedState\n accept\n WSAStartup\n connect\n closesocket\n send\n listen\n recv\n socket\n bind\n recvfrom\n sendto","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$24","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"TNODUP-Portable.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Reads Antivirus engine related registry keys","description":"\"TNODUP-Portable.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\NOD\\CURRENTVERSION\\INFO\")\n \"TNODUP-Portable.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\ESET SECURITY\\CURRENTVERSION\\INFO\")","origin":"Registry Access","mitre_attack_id":"T1063","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/70 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/19 Antivirus vendors marked sample as malicious (42% detection rate)\n 45/70 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007920.00000000.82321.02B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007920.00000000.82321.00400000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter() unexpected failed (%s), will not use it.\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Possibly contains Public/Private key (encryption)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use AES encryption instructions\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"TNODUP-Portable.exe\" called \"IsWow64Process\" with parameter \"7920\" - (UID: 00000000-00007920)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"TNODUP-Portable.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007920)\n \"TNODUP-Portable.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00007920)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"TNODUP-Portable.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007920)\n \"TNODUP-Portable.exe\" called \"RtlGetVersion\" (UID: 00000000-00007920)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"TNODUP-Portable.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set last focus to %s(%s)\" (Indicator: \"set \"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found string \"set bitmap on button tools.\" (Indicator: \"set \"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found string \"set timeouts for state %d; Total %ld, retry %d maxtry %d\" (Indicator: \"set \"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found string \"set filename failed\" (Indicator: \"set \"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"TNODUP-Portable.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"Found reference to native API (Indicator: \"RtlGetVersion\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to native API (Indicator: \"VerSetConditionMask\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to native API (Indicator: \"RtlUnwind\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to native API (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to native API (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to native API (Indicator: \"RtlUnwind\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 2603538)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"wxWindow::RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"wxWindow::RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"DdeGetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"DdeGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 OPR/45.0.2552.812\" (Indicator: \"mozilla/5.0 (\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\"TNODUP-Portable.exe\" loaded module \"C:\\TNODUP-Portable.exe\" at 00400000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$35","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"TNODUP-Portable.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74130000\n \"TNODUP-Portable.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 723B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"TNODUP-Portable.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 760E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" was detected as \"Microsoft Visual C++\" and name: \"Compiler\"\n \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" was detected as \"wxWidgets\" and name: \"Library\"\n \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" has an writable section named \".data\"\n \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" file has an entrypoint instructions - \"call\t0x66d8a1,jmp\t0x66ceb0,push\t0x10,push\t0x88edc0,call\t0x66d5e0,xor\tebx, ebx,mov\tdword ptr [ebp - 0x20], ebx,mov\tbyte ptr [ebp - 0x19], bl,mov\tdword ptr [ebp - 4], ebx,cmp\tebx, dword ptr [ebp + 0x10],je\t0x66d066,mov\tecx, dword ptr [ebp + 0x14],call\t0x66d4d5,mov\tecx, dword ptr [ebp + 8],call\tdword ptr [ebp + 0x14],mov\teax, dword ptr [ebp + 0xc],add\tdword ptr [ebp + 8], eax,inc\tebx,mov\tdword ptr [ebp - 0x20], ebx,jmp\t0x66d047,mov\tal, 1,mov\tbyte ptr [ebp - 0x19], al,mov\tdword ptr [ebp - 4], 0xfffffffe,call\t0x66d085,call\t0x66d626,ret\t0x14,mov\tebx, dword ptr [ebp - 0x20],mov\tal, byte ptr [ebp - 0x19],test\tal, al,jne\t0x66d098,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x376e00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x11a800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x376c0a\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x11a74e\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"TNODUP-Portable.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"TNODUP-Portable.exe\" allocated memory in \"C:\\TNODUP-Portable.exe\" with (Protection: \"read/write\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"TNODUP-Portable.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"TNODUP-Portable.exe\" queries basic process information of the \"C:\\TNODUP-Portable.exe\" (UID: 7920)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"TNODUP-Portable.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007920)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\WININET.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\WINHTTP.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\WSOCK32.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\IERTUTIL.DLL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\iertutil.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\TNODUP-PORTABLE.EXE.LOCAL\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\TNODUP-PORTABLE.INI\"\n \"TNODUP-Portable.exe\" trying to access non-existent file \"C:\\TNODUP-Portable.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"TNODUP-Portable.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00007920)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy Username and Password\" (Indicator: \"copy \") in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\n Observed string: \"Copy License Key\" (Indicator: \"copy \") in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\n Observed string: \"Copy to Clipboard\" (Indicator: \"copy \") in Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\n Observed string: \"Copy selection\" (Indicator: \"copy \") in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"smtps\" (Indicator: \"smtp\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found string \"SMTP.\" (Indicator: \"smtp\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found string \"SMTPS\" (Indicator: \"smtp\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found string \"Got unexpected smtp-server response: %d\" (Indicator: \"smtp\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"imap.\" [Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp]\n Observed email domain:\"smtp.\" [Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp]\n Observed email domain:\"pop3.\" [Source: 00000000-00007920.00000000.82321.00778000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://edf.eset.com\"\n Found HTTPS url \"https://my.eset.com\"\n Found HTTPS url \"https://curl.haxx.se\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$40","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://iploc.eset.com:80\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://login.live.com/ppsecure/DeviceUpdate.srf","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007920\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"$42","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"$43","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where has the event handler gone?\" (Indicator: \"where \"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found string \"where has the event handler gone?\" (Indicator: \"where \"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"pGetComputerName\" (Indicator: \"GetComputerName\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"eGetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"gethostname() failed, continuing without!\" (Indicator: \"gethostname\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"gethostname() failed, continuing without!\" (Indicator: \"gethostname\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007920.00000000.82321.02B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyEx\" (Indicator: \"RegDeleteKey\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyEx\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"TNODUP-Portable.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to unmap view of a section from a process","description":"\"TNODUP-Portable.exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"BaseAddress\": \"4c50000\"}\n \"TNODUP-Portable.exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"BaseAddress\": \"4c40000\"}\n \"TNODUP-Portable.exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"BaseAddress\": \"1f0000\"}","origin":"API Call","mitre_attack_id":"T1055.012","relevance":1,"id":"api-261","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007920.00000000.82321.00778000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"TNODUP-Portable.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".tls with unusual entropies 0.0203931352361","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"satbadkd@gmail.com\"\n Pattern match: \"oleg_r_ukr@ukr.net\"\n Pattern match: \"mr_cyberneo@hotmail.com\"\n Pattern match: \"byprogressivetr@gmail.com\"\n Pattern match: \"real@zoznam.sk\"\n Pattern match: \"tukero@gmail.com\"\n Pattern match: \"ftp@example.com\"\n Pattern match: \"s@k.s0z.sp\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"Network Related","name":"POSTs data to a webserver (HTTPS)","description":"POST /ppsecure/DeviceUpdate.srf HTTP/1.0Connection: Keep-Alive\n Content-Type: application/soap+xml\n Accept: */*\n User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 16.10.0.16299.0.0; IDCRL-cfg 16.0.28985.0; App svchost.exe, 10.0.16299.15, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})\n Content-Length: 9298\n Host: login.live.com\n with payload ==> \" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$53","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"TNODUP-Portable.exe.bin\" has a section named \".gfids\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$54","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]}],"incidents":[{"name":"Evasive","details_count":2,"details":[{"detail":"Reads Antivirus engine related registry keys"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":85,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["adload","adware","hackav","refresh","scrinject","zdengo","pua"],"sample_flags":["TOR analysis","Network Traffic"],"sandbox_reports":[{"id":"64813cb9da7798341e004ee0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Hacktool","submit_name":"TNODUP-Portable.exe","analysis_start_time":"2023-06-08T02:30:39+00:00","indicators_count":{"informative":155,"suspicious":27,"malicious":4},"is_in_unified_schema":true},{"id":"5abaaa917ca3e135cb1a0ce4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Generic","contacted_countries":["SVK"],"submit_name":"TNODUP-Portable.exe","analysis_start_time":"2018-03-27T22:34:23+00:00","indicators_count":{"informative":11,"suspicious":15,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"5a9a9e797ca3e16b292773ba","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Hacktool","submit_name":"TNODUP-Portable.exe","analysis_start_time":"2019-08-12T18:43:36+00:00","indicators_count":{"informative":11,"suspicious":12,"malicious":4},"tags":["TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"91.228.167.125","port":80,"protocol":"TCP","country":"Slovakia (SLOVAK Republic)","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]}],"dns_resolutions":[{"domain":"iploc.eset.com","address":"91.228.165.81","ttl":6493,"country":"Slovakia (SLOVAK Republic)","registrar_name":"Register.com, Inc.","registrar_organization":"ESET, spol. s r.o.","registrar_creation_date":"2001-04-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}],"processes":[{"pid":3952,"ppid":0,"name":"TNODUP-Portable.exe","command_line":"/b","sha256":"d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa","normalized_path":"C:\\TNODUP-Portable.exe","uid":"00025012-00003952","icon":"$55"}],"all_imported_dlls":["advapi32.dll","userenv.dll","kernel32.dll","rpcrt4.dll","shlwapi.dll","profapi.dll","comctl32.dll","shell32.dll","imm32.dll","imageres.dll","ole32.dll","wow64.dll","KernelBase.dll","msvcrt.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","iertutil.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","winhttp.dll","webio.dll","wow64win.dll","version.dll","wsock32.dll","nsi.dll","comdlg32.dll","oleaut32.dll","uxtheme.dll","dwmapi.dll","wow64cpu.dll","wininet.dll","sspicli.dll","cryptbase.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","msvcr100.dll","clbcatq.dll","ntdll.dll","user32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","gdi32.dll","lpk.dll","usp10.dll","api-ms-win-downlevel-version-l1-1-0.dll","normaliz.dll","sechost.dll","ws2_32.dll","Wldap32.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","duser.dll","xmllite.dll","combase.dll","windows.storage.dll","powrprof.dll","bcrypt.dll","dnsapi.dll","cfgmgr32.dll","pnrpnsp.dll","FWPUCLNT.DLL","mswsock.dll","winnsi.dll","ucrtbase.dll","msvcp_win.dll","win32u.dll","fltLib.dll","NapiNSP.dll","IPHLPAPI.DLL","winrnr.dll","OnDemandConnRouteHelper.dll","kernel.appcore.dll","bcryptprimitives.dll","gdi32full.dll","rasadhlp.dll","apphelp.dll","VxSSL32.dll","SHCore.dll","nlaapi.dll","WSHTCPIP.DLL","msasn1.dll","crypt32.dll","tzres.dll","rasapi32.dll","rasman.dll","rtutils.dll","urlmon.dll","ntmarta.dll","SensApi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\duser.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\TUKERO[X]TEAM\\TNOD USER & PASSWORD FINDER\\","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKCU\\SOFTWARE\\TUKERO[X]TEAM\\","sources":[{"report_type":"sandbox","report_id":"5a9a9e797ca3e16b292773ba"},{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKCUHKCU\\SOFTWARE\\TUKERO[X]TEAM\\TNOD USER & PASSWORD FINDER\\","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"key":"HKCUHKCU\\SOFTWARE\\TUKERO[X]TEAM\\","sources":[{"report_type":"sandbox","report_id":"64813cb9da7798341e004ee0"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\TNODUP-PORTABLE_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\TNODUP-PORTABLE_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!owppjrw!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!owppjrw!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!owppjrw!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Local\\c:!users!owppjrw!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Local\\c:!users!owppjrw!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]},{"name":"Local\\c:!users!owppjrw!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5abaaa917ca3e135cb1a0ce4"}]}]}},"report_ids":{"sandbox_job_ids":["64813cb9da7798341e004ee0","5abaaa917ca3e135cb1a0ce4","5a9a9e797ca3e16b292773ba"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Sample d995cbebb6fb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d995cbebb6fb…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample d995cbebb6fb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d995cbebb6fb…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d995cbebb6fb5373a710963457c8a85b6e6505758e8d607d45f1735ed91438aa"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample d995cbebb6fb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d995cbebb6fb…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]]