26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.PasswordStealerA.Generic Sample df9104032c91… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample df9104032c91…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683","keywords":["Malicious","MSIL.PasswordStealerA.Generic","malware analysis","sandbox report","threat intelligence","df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683"],"about":{"@type":"SoftwareApplication","name":"1AE8B0E8C75365C47271340258DB93E0.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.PasswordStealerA.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Taff,Found reference to "PbeSha1_RC2_40" (Indicator: "RC2"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "RC2_CBC_40" (Indicator: "RC2"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "SRTP_NULL_HMAC_SHA1_80" (Indicator: "HMAC"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "HMAC"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "HMAC_SHA1" (Indicator: "HMAC"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "EncryptionECDsaWithSha1" (Indicator: "ECDsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "TRAILER_SHA512" (Indicator: "SHA512"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "ecka_eg_X963kdf_SHA512" (Indicator: "SHA512"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "sphincs256_with_SHA512" (Indicator: "SHA512"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "xmss_with_SHA512" (Indicator: "SHA512"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "xmss_mt_with_SHA512" (Indicator: "SHA512"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "ecdsa_plain_SHA512" (Indicator: "SHA512"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "EncryptionECDsaWithSha512" (Indicator: "ECDsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "SRTP_NULL_HMAC_SHA1_32" (Indicator: "HMAC"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "HMAC"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "Aes192" (Indicator: "Aes"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "ECDsaWithSha2" (Indicator: "ECDsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "TRAILER_SHA512_224" (Indicator: "SHA512"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "EncryptionECDsaWithSha224" (Indicator: "ECDsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "RC2_64" (Indicator: "RC2"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found reference to "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "1AE8B0E8C75365C47271340258DB93E0.exe")28:Td8f,Found string "[PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Private key passed - public key expected." (Indicator: "private key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Private key passed - public key expected." (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Public Key:" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Public key presented not for certificate signature" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Public key certificate for attribute certificate cannot be searched." (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Subject public key cannot be decoded." (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Public key of issuer certificate of CRL could not be retrieved." (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Attribute certificate issuer is also a public key certificate issuer." (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Public key certificate specified in base certificate ID for attribute certificate cannot be found." (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Certification path for public key certificate of attribute certificate could not be build." (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Trusted CA Public Key:" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "expected public key" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Unrecognized curve OID for GostR3410x2001 private key" (Indicator: "private key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "algorithm identifier in private key not recognised" (Indicator: "private key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "error recovering GOST3410_2001 public key" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "invalid length for GOST3410_2001 public key" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "error recovering GOST3410_94 public key" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "error recovering GOST3410_2012 public key" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "invalid length for GOST3410_2012 public key" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "algorithm identifier in public key not recognised:" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Expected a public key" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Expected a private key" (Indicator: "private key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "invalid DH public key" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "OID is not a valid public key parameter set" (Indicator: "public key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "EOF encountered in middle of Ed25519 private key" (Indicator: "private key"; File: "1AE8B0E8C75365C47271340258DB93E0.exe")29:Ta3e,"1AE8B0E8C75365C47271340258DB93E0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006b00a0010000000000000000000000000000000000001e006600a00100000000000000000000706b6d0000000000200000000000000000000000e8486f0060686d0080696d0000956f00286d6d0000000000d4f39b000000000030f69b0095e1d5773e4d3700feffffffff2bd9779a2ad97764c5ba77b69fd977000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c5ba7700956f0064c5ba77 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e02b6d00000000006a04000000210000402b6d00fe03000030067100000000007e0400007cf521008000000008f7210095e1d57726433700feffffff0000000002000002d096700037210016010000008aa2307700000000ff07000090f6210037210016300671000100000030067100020000000c00000040de700040de70003bde700000000000cc7d7e0000006d0000000001fcf5210024477e731cfc210095e1d57706433700feffffff435cd9775059d97794000000a00000003ade700038de700094000000a0f72100fdfe307744f7210048f721001000000001000000 (UID: 00000000-00002560)2a:Tacc,"1AE8B0E8C75365C47271340258DB93E0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b0df6f0044f69b00145cd977435cd97710f79b000100000094016d0001000000c4f59b00935cda774083e177d4a0d977eaa4757710f79b00010000000100000060bb6f000000000094f59b00c4f59b0030f69b0095e1d577d6553700feffffffd4a0d9771bbedc750000b57700000000 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30323a35312e323033222c52583d302c50583d300030006c69634b6579546f6b656e3d623033663566376631316435306133612220616c6c6f77446566696e6974696f6e3d224d616368696e65 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb9b775884770000d0fd7f9a5cda7700f0fd7f40e4210044d0fd7f00000000400000003f0000001d00000000d0fd7f34e42100c15cda776082e1771d00000000d0fd7f9a5cda7700f0fd7f58e421005789d9778083e1771317dd75d8eb9b77 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100005eb5cf77000098770000000000000000f000987702000000000000008800000095e1d57778e42100459dee770000c900000000008000000002000000000022009c1d15748ce421006c22157480000000d3221574dcf01574a8e42100741d1574dcf0157400000000d8e5210000000000 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000beb5cf77000098770000000000000000f000987702000000000000008800000095e1d57798e42100459dee770000c900000000008000000002000000000022009c1d1574ace421006c22157480000000d3221574dcf01574c8e42100741d1574dcf0157400000000f8e5210000000000 (UID: 00000000-00002560) "MSSafetyScanner.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b0df440094f76100145cd977435cd97760f8610001000000940142000100000014f76100935cda774083e177d4a0d9770c50927760f86100010000000100000000bf440000000000e4f6610014f7610080f7610095e1d577e0a32a00feffffffd4a0d9771bbedc750000b57700000000 (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005500688b45000e00000e3420000068da450060b64400570053005c0041007000700044006100740061005c004c006f00630061006c000800000864200000d08d450060b6440073005c0050007900740068006f006e005c005000 (UID: 00000000-00000900)2b:T3cee,"1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter certcli.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dsrole.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter crypt32 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002560) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000584) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000584) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000584) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000584) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000584) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000584) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000584) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000900) "MSSafetyScanner.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000900)2c:T132bb,"1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptFindOIDInfoW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CAOIDGetLdapURL (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CAOIDFreeLdapURL (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DsRoleGetPrimaryDomainInformation (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DsRoleFreeMemory (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptDecodeObject (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptDecodeObjectW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CryptVerifySignatureW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter PostThreadMessage (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00002560) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00000584) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000584) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00000900) "MSSafetyScanner.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00000900)2d:Tbe3,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "BraveSoftware\Brave-Browser\User Data\Local State" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Opera Software\Opera GX Stable\Login Data" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Opera Software\Opera GX Stable\Local State" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Opera Software\Opera Stable\Login Data" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Opera Software\Opera Stable\Local State" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000042-_~_ "SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions" in Source: 600007f-_~ReadAccounts "BraveSoftware\\Brave-Browser\\User Data\\Default\\Login Data" in Source: 6000087-_~ReadAccounts "BraveSoftware\\Brave-Browser\\User Data\\Local State" in Source: 6000087-_~ReadAccounts "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2" in Source: 60000d7-_~_ "Opera Software\\Opera GX Stable\\Login Data" in Source: 600011c-_~ReadAccounts "Opera Software\\Opera GX Stable\\Local State" in Source: 600011c-_~ReadAccounts "Opera Software\\Opera Stable\\Login Data" in Source: 600011f-_~ReadAccounts "Opera Software\\Opera Stable\\Local State" in Source: 600011f-_~ReadAccounts "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 60001c8-_~_ "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: 60001c8-_~_ "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 60001c8-_~_ "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: 60001c8-_~_ "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000900.00000001.78219.00330000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000900.00000001.78219.00330000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002560.00000001.68677.006C0000.00000004.mdmp 00000000-00002560.00000003.76128.006C0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002560.00000001.68677.006C0000.00000004.mdmp 00000000-00002560.00000003.76128.006C0000.00000004.mdmp2e:T10ec,"1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "1AE8B0E8C75365C47271340258DB93E0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "MSSafetyScanner.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]2f:T3281,"1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "GDI32.DLL" at base 774c0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77220000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 711d0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "KERNEL32" at base 772c0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "ADVAPI32.DLL" at base 779d0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72930000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "SHLWAPI.DLL" at base 760e0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "VERSION.DLL" at base 750e0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 65840000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "USER32.DLL" at base 77510000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "MSCOREE.DLL" at base 729c0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "PSAPI.DLL" at base 772b0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "KERNEL32.DLL" at base 772c0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 64430000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "RPCRT4.DLL" at base 77170000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "OLE32.DLL" at base 75f80000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "CRYPTBASE.DLL" at base 75b40000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 748f0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 737a0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6bcd0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 639d0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 66660000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62b60000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6dae0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62340000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6bbc0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 61bc0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "NTDLL.DLL" at base 77d40000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "SHELL32.DLL" at base 76140000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 776b0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "PROFAPI.DLL" at base 75c60000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "BCRYPT.DLL" at base 75760000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "CRYPTSP.DLL" at base 75650000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 753e0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "UXTHEME.DLL" at base 748f0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "COMCTL32.DLL" at base 74b10000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "DWMAPI.DLL" at base 745c0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "ADVAPI32" at base 779d0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "CRYPT32.DLL" at base 75e30000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72180000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "CRYPTNET.DLL" at base 72180000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "SENSAPI.DLL" at base 73880000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "CERTCLI.DLL" at base 73820000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\SYSTEM32\DSROLE.DLL" at base 74230000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32" at base 0 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "CRYPT32" at base 75e30000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "CERTCLI.DLL" at base 6baf0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "SSPICLI.DLL" at base 75ad0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 776b0000 "1AE8B0E8C75365C47271340258DB93E0.exe" loaded module "RPCRTREMOTE.DLL" at base 75be0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 711d0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 772c0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 748f0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77170000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 776b0000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 779d0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 77620000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 74260000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75ad0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 74460000 "MSSafetyScanner.exe" loaded module "GDI32.DLL" at base 774c0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77220000 "MSSafetyScanner.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 711d0000 "MSSafetyScanner.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "MSSafetyScanner.exe" loaded module "KERNEL32" at base 772c0000 "MSSafetyScanner.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "MSSafetyScanner.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6be20000 "MSSafetyScanner.exe" loaded module "ADVAPI32.DLL" at base 779d0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72930000 "MSSafetyScanner.exe" loaded module "SHLWAPI.DLL" at base 760e0000 "MSSafetyScanner.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "MSSafetyScanner.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "MSSafetyScanner.exe" loaded module "VERSION.DLL" at base 750e0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 65090000 "MSSafetyScanner.exe" loaded module "USER32.DLL" at base 77510000 "MSSafetyScanner.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "MSSafetyScanner.exe" loaded module "MSCOREE.DLL" at base 729c0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "MSSafetyScanner.exe" loaded module "KERNEL32.DLL" at base 772c0000 "MSSafetyScanner.exe" loaded module "RPCRT4.DLL" at base 77170000 "MSSafetyScanner.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63c80000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "MSSafetyScanner.exe" loaded module "OLE32.DLL" at base 75f80000 "MSSafetyScanner.exe" loaded module "CRYPTBASE.DLL" at base 75b40000 "MSSafetyScanner.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 748f0000 "MSSafetyScanner.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73880000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6bc40000 "MSSafetyScanner.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63220000 "MSSafetyScanner.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 664b0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 623b0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 73830000 "MSSafetyScanner.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61b90000 "MSSafetyScanner.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 66700000 "MSSafetyScanner.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 65870000 "MSSafetyScanner.exe" loaded module "NTDLL.DLL" at base 77d40000 "MSSafetyScanner.exe" loaded module "SHELL32.DLL" at base 76140000 "MSSafetyScanner.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 776b0000 "MSSafetyScanner.exe" loaded module "PROFAPI.DLL" at base 75c60000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "MSSafetyScanner.exe" loaded module "BCRYPT.DLL" at base 75760000 "MSSafetyScanner.exe" loaded module "CRYPTSP.DLL" at base 75650000 "MSSafetyScanner.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 753e0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "MSSafetyScanner.exe" loaded module "PSAPI.DLL" at base 772b0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "MSSafetyScanner.exe" loaded module "UXTHEME.DLL" at base 748f0000 "MSSafetyScanner.exe" loaded module "COMCTL32.DLL" at base 74b10000 "MSSafetyScanner.exe" loaded module "DWMAPI.DLL" at base 745c0000 "MSSafetyScanner.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 030:Tec4,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00002560-00000C25-46314093] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002560-00000C25-46563098] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002560-00000C25-46648678] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002560-00000C25-46860787] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002560-00000C25-46901396] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002560-00000C25-47004077] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002560-00000C25-47034990] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002560-00000C25-47064387] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002560-00000C25-47164208] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002560-00000C25-47209427] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002560-00000C25-47248633] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002560-00000C25-47283787] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002560-00000C25-47383133] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002560-00000C25-47423749] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002560-00000C25-47441060] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002560-00000C25-47481537] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002560-00000C25-47580163] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002560-00000C25-47968294] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00002560-00000C25-48201494] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002560-00000C25-48646176] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00002560-00000C25-75021909] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00002560-00000C25-75068847] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00002560-00000C25-75185552] Observed system executable string:"%WINDIR%\system32\dsrole.dll" [Source: 00000000-00002560-00000C25-75575034]31:T7f8,"1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "")32:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")33:Tc94,"1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "1AE8B0E8C75365C47271340258DB93E0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "")34:T5c5,"1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "1AE8B0E8C75365C47271340258DB93E0.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"35:T607,"1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\FLTLIB.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"36:T6b1,"1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll"37:T805,"1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\1AE8B0E8C75365C47271340258DB93E0.exe.config" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Client\" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\1AE8B0E8C75365C47271340258DB93E0.INI" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\1AE8B0E8C75365C47271340258DB93E0.exe.Local\" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "C:\1AE8B0E8C75365C47271340258DB93E0.exe:Zone.Identifier" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "\Device\HarddiskVolume2\1AE8B0E8C75365C47271340258DB93E0.EXE.CONFIG" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\CLIENT" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "\Device\HarddiskVolume2\1AE8B0E8C75365C47271340258DB93E0.INI" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "\Device\HarddiskVolume2\1AE8B0E8C75365C47271340258DB93E0.EXE.LOCAL" "1AE8B0E8C75365C47271340258DB93E0.exe" trying to access non-existent file "\Device\HarddiskVolume2\1AE8B0E8C75365C47271340258DB93E0.exe:ZONE.IDENTIFIER"38:T620,"2.5.29.19" "2.5.29.15" "2.5.29.37" "2.5.29.17" "2.5.29.18" "1.3.132.0" "2.5.1.1" Potential IP "2.4.8.1" found in string "2.4.8.1+cce1c58590" "2.4.0.0" "1.9.0.1" "4.4.3.4" "2.2.3.2" "2.5.4.5" "2.5.4.72" "2.5.29.9" "2.5.29.14" "2.5.29.16" "2.5.29.20" "2.5.29.21" "2.5.29.23" "2.5.29.24" "2.5.29.27" "2.5.29.28" "2.5.29.29" "2.5.29.30" "2.5.29.31" "2.5.29.32" "2.5.29.33" "2.5.29.35" "2.5.29.36" "2.5.29.46" "2.5.29.54" "2.5.29.56" "2.5.29.55" "2.5.29.60" "2.5.4.6" "2.5.4.10" "2.5.4.11" "2.5.4.12" "2.5.4.3" "2.5.4.9" "2.5.4.7" "2.5.4.8" "2.5.4.4" "2.5.4.42" "2.5.4.43" "2.5.4.44" "2.5.4.45" "2.5.4.15" "2.5.4.17" "2.5.4.46" "2.5.4.65" "2.5.4.16" "2.5.4.54" "2.5.4.20" "2.5.4.41" "2.5.4.97" "1.3.36.8" "1.3.1.1" "1.2.2.1" "1.2.2.2" "1.2.2.3" "1.2.2.4" "1.2.2.5" "1.2.2.6" "1.3.36.3" "103.168.19.82:47" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral," Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=neutral," Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e08" "192.168.241.82" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Cul", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Culture=neu"39:Tbac,"1AE8B0E8C75365C47271340258DB93E0.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00002560) "1AE8B0E8C75365C47271340258DB93E0.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002560)3a:Tb85,Found string "P~AeS" (Indicator: "aes"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "PQAeS~" (Indicator: "aes"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "mChacha20" (Indicator: "chacha"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecdsa_plain_RIPEMD160" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "aes"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "aes128"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecdsa_plain_SHA1" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "id_TA_ECDSA_SHA_1" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "EncryptionECDsaWithSha1" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecdsa_sha1" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecdsa_plain_SHA512" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "IdEcdsaWithSha3_512" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "id_TA_ECDSA_SHA_512" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "THREEFISH_512" (Indicator: "threefish"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "EncryptionECDsaWithSha512" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecdsa_secp521r1_sha512" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecdsa_brainpoolP512r1tls13_sha512" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "aes"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "aes128"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecka_eg_SessionKDF_AES192" (Indicator: "aes"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecka_eg_SessionKDF_AES192" (Indicator: "aes192"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "AES_192" (Indicator: "aes"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Aes192" (Indicator: "aes"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Aes192" (Indicator: "aes192"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ECDsaWithSha2" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "THREEFISH_1024" (Indicator: "threefish"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "ecdsa_plain_SHA224" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "IdEcdsaWithSha3_224" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "id_TA_ECDSA_SHA_224" (Indicator: "ecdsa"; File: "1AE8B0E8C75365C47271340258DB93E0.exe")3b:T9d3,Found string "passwordBasedMac" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "password_value" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Export of key material requires extended_master_secret" (Indicator: "secret"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "no password supplied when one expected" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "cannot export keying material without extended_master_secret" (Indicator: "secret"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "BCrypt password must be <= 72 bytes" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Missing password." (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "extended_master_secret" (Indicator: "secret"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "password" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "extended master secret" (Indicator: "secret"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "master secret" (Indicator: "secret"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "PKCS12 key store MAC invalid - wrong password or corrupted file." (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "password supplied for keystore that does not require one" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "No password finder specified, but a password is required" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Password is null, but a password is required" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Partner MacTag validation failed. Therefore, the password, MAC, or digest algorithm of each participant does not match." (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "verification requires password check" (Indicator: "password"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "can't create secret key object:" (Indicator: "secret"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "exception decrypting secret key" (Indicator: "secret"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "secret key ring doesn't start with secret key tag: tag 0x" (Indicator: "secret"; File: "1AE8B0E8C75365C47271340258DB93E0.exe")3c:T410,Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "1AE8B0E8C75365C47271340258DB93E0.exe") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; File: "1AE8B0E8C75365C47271340258DB93E0.exe")3d:Tf1b,Gma.System.MouseKeyHook.Implementation.MouseListener::OnMove(System.Windows.Forms.MouseEventArgs) at 1ae8b0e8c75365c47271340258db93e0-6000a17-MouseListener~ProcessMove Gma.System.MouseKeyHook.Implementation.MouseListener::OnWheel(System.Windows.Forms.MouseEventArgs) at 1ae8b0e8c75365c47271340258db93e0-6000a14-MouseListener~ProcessWheel Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009c7-EventFacade~add_MouseDownExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009cc-EventFacade~remove_MouseUpExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009d1-EventFacade~add_MouseDoubleClick Gma.System.MouseKeyHook.Implementation.MouseListener::ProcessDragStarted(Gma.System.MouseKeyHook.MouseEventExtArgs&) at 1ae8b0e8c75365c47271340258db93e0-6000a18-MouseListener~ProcessDrag Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009c2-EventFacade~remove_MouseMoveExt Gma.System.MouseKeyHook.Implementation.MouseListener::ProcessUp(Gma.System.MouseKeyHook.MouseEventExtArgs&) at 1ae8b0e8c75365c47271340258db93e0-60009b1-GlobalMouseListener~ProcessUp Gma.System.MouseKeyHook.Implementation.MouseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 1ae8b0e8c75365c47271340258db93e0-600099c-ctor Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 1ae8b0e8c75365c47271340258db93e0-60009bc-EventFacade~remove_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009d4-EventFacade~remove_MouseDragStarted Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 1ae8b0e8c75365c47271340258db93e0-6000999-ctor Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009cf-EventFacade~add_MouseWheelExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009c3-EventFacade~add_MouseClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 1ae8b0e8c75365c47271340258db93e0-60009ba-EventFacade~remove_KeyDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009bf-EventFacade~add_MouseMove Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009ca-EventFacade~remove_MouseUp Gma.System.MouseKeyHook.Implementation.MouseListener::OnDragStarted(System.Windows.Forms.MouseEventArgs) at 1ae8b0e8c75365c47271340258db93e0-6000a19-MouseListener~ProcessDragStarted Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009cb-EventFacade~add_MouseUpExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009d2-EventFacade~remove_MouseDoubleClick Gma.System.MouseKeyHook.Implementation.MouseListener::OnUp(System.Windows.Forms.MouseEventArgs) at 1ae8b0e8c75365c47271340258db93e0-6000a16-MouseListener~ProcessUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009c5-EventFacade~add_MouseDown Gma.System.MouseKeyHook.Implementation.BaseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 1ae8b0e8c75365c47271340258db93e0-6000a2a-ctor Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009ce-EventFacade~remove_MouseWheel Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009d8-EventFacade~remove_MouseDragFinished3e:Tec2,System.Net.Sockets.Socket::get_OSSupportsIPv6() at 1ae8b0e8c75365c47271340258db93e0-6000c87-_~_ System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 1ae8b0e8c75365c47271340258db93e0-600074b-RuntimeTypeModel~WriteGetKeyImpl Gma.System.MouseKeyHook.Implementation.MouseListener::OnMove(System.Windows.Forms.MouseEventArgs) at 1ae8b0e8c75365c47271340258db93e0-6000a17-MouseListener~ProcessMove Gma.System.MouseKeyHook.Implementation.MouseListener::OnWheel(System.Windows.Forms.MouseEventArgs) at 1ae8b0e8c75365c47271340258db93e0-6000a14-MouseListener~ProcessWheel Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009c7-EventFacade~add_MouseDownExt System.Type::GetConstructors(System.Reflection.BindingFlags) at 1ae8b0e8c75365c47271340258db93e0-6000832-ValueMember~BuildSerializer Org.BouncyCastle.Tls.TlsUtilities::IsTimeout(System.Net.Sockets.SocketException) at 1ae8b0e8c75365c47271340258db93e0-6001418-DtlsTransport~Send Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009cc-EventFacade~remove_MouseUpExt Org.BouncyCastle.Tls.ClientHello::get_BindersSize() at 1ae8b0e8c75365c47271340258db93e0-60015f1-TlsClientProtocol~SendClientHelloMessage Org.BouncyCastle.Tls.OfferedPsks::GetBindersSize(Org.BouncyCastle.Tls.TlsPsk[]) at 1ae8b0e8c75365c47271340258db93e0-6001981-TlsUtilities~AddPreSharedKeyToClientHello Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009d1-EventFacade~add_MouseDoubleClick Gma.System.MouseKeyHook.Implementation.MouseListener::ProcessDragStarted(Gma.System.MouseKeyHook.MouseEventExtArgs&) at 1ae8b0e8c75365c47271340258db93e0-6000a18-MouseListener~ProcessDrag System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 1ae8b0e8c75365c47271340258db93e0-6000635-EmitWrite 䥼ॷﬧ室뻈⢓⫨ꧤᵥ�衶䘖赀쎋⫇᳸仠ꛯ::SetKeepAliveEx(System.Net.Sockets.Socket,System.UInt32,System.UInt32) at 1ae8b0e8c75365c47271340258db93e0-6000140-_~_ Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009c2-EventFacade~remove_MouseMoveExt Gma.System.MouseKeyHook.Implementation.MouseListener::ProcessUp(Gma.System.MouseKeyHook.MouseEventExtArgs&) at 1ae8b0e8c75365c47271340258db93e0-60009b1-GlobalMouseListener~ProcessUp Gma.System.MouseKeyHook.Implementation.MouseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 1ae8b0e8c75365c47271340258db93e0-600099c-ctor System.Net.Sockets.SocketException::get_SocketErrorCode() at 1ae8b0e8c75365c47271340258db93e0-600197f-TlsUtilities~IsTimeout Org.BouncyCastle.Tls.TlsUtilities::CalculatePskBinder(Org.BouncyCastle.Tls.Crypto.TlsCrypto,System.Boolean,System.Int32,Org.BouncyCastle.Tls.Crypto.TlsSecret,System.Byte[]) at 1ae8b0e8c75365c47271340258db93e0-6001493-OfferedPsks~EncodeBinders Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 1ae8b0e8c75365c47271340258db93e0-60009bc-EventFacade~remove_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009d4-EventFacade~remove_MouseDragStarted System.Type::GetProperty(System.String,System.Reflection.BindingFlags) at 1ae8b0e8c75365c47271340258db93e0-6000366-Helpers~GetProperty Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 1ae8b0e8c75365c47271340258db93e0-6000999-ctor System.Net.Sockets.Socket::Close() at 1ae8b0e8c75365c47271340258db93e0-6000058-_~_ Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 1ae8b0e8c75365c47271340258db93e0-60009cf-EventFacade~add_MouseWheelExt3f:T68b,"BraveSoftware\Brave-Browser\User Data\Default\Login Data" (Indicator: "bravesoftware\brave-browser\user data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "BraveSoftware\Brave-Browser\User Data\Local State" (Indicator: "bravesoftware\brave-browser\user data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Google\Chrome\User Data\Local State" (Indicator: "google\chrome\user data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Microsoft\Edge\User Data\Default\Login Data" (Indicator: "microsoft\edge\user data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Microsoft\Edge\User Data\Local State" (Indicator: "microsoft\edge\user data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Mozilla\Firefox\Profiles" (Indicator: "mozilla\firefox\") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Opera Software\Opera GX Stable\Login Data" (Indicator: "opera software\opera gx stable\login data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Opera Software\Opera Stable\Login Data" (Indicator: "opera software\opera stable\login data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Opera Software\Opera Stable\Local State" (Indicator: "opera software\opera stable\local state") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Yandex\YandexBrowser\User Data\Default\Ya Passman Data" (Indicator: "yandex\yandexbrowser\user data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe "Yandex\YandexBrowser\User Data\Local State" (Indicator: "yandex\yandexbrowser\user data") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe40:T98c,"MSSafetyScanner.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "SEARCHLIST"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "NAMESERVER"; Value: "") "MSSafetyScanner.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "")41:Ta80,"MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")42:T53d,"MSSafetyScanner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "MSSafetyScanner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")43:T548,"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive" "HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 20:37:32 GMTContent-Type: application/json; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveServer: ipwhoisAccess-Control-Allow-Headers: *X-Robots-Tag: noindex" "403{ "About Us": "https:\/\/ipwhois.io", "ip": "67.218.111.202", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "California", "region_code": "CA", "city": "San Jose", "latitude": 37.3382082, "longitude": -121.8863286, "is_eu": false, "postal": "95113", "calling_code": "1", "capital": "Washington D.C.", "borders": "CA MX", "flag": { "img": "https:\/\/cdn.ipwhois.io\/flags\/us.svg", "emoji": "\ud83c\uddfa\ud83c\uddf8", "emoji_unicode": "U+1F1FA U+1F1F8" }, "connection": { "asn": 11404, "org": "Wave Broadband", "isp": "Wave Broadband", "domain": "wavebroadband.com" }, "timezone": { "id": "America\/Los_Angeles", "abbr": "PST", "is_dst": false, "offset": -28800, "utc": "-08:00", "current_time": "2023-11-27T12:37:32-08:00" }}"44:T10a3,Found URL "https://stackoverflow.com/q/2152978/23354annot" - Source: "00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp") Found URL "https://stackoverflow.com/q/11564914/23354;" - Source: "00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp") Found URL "https://stackoverflow.com/q/14436606/23354t" - Source: "00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp") Found URL "https://stackoverflow.com/q/2152978/23354annot" - Source: "00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp") Found URL "https://stackoverflow.com/q/11564914/23354;" - Source: "00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp") Found URL "https://stackoverflow.com/q/14436606/23354t" - Source: "00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00005628.00000000.77305.1DE12000.00000004.mdmp") Found URL "https://npcap.com/>) at 1ae8b0e8c75365c47271340258db93e0-60001d3-_~_\n 涅羛玻ۚ諊選鄣僁୍抒�昢憎붌躶鋞轼쎪秱::ꥤ㙪揼鰹彷⧓葭�㕴緵鳢ਧ괵ሢ뾁㩼⚩坮壐(켼蘚䶓㲲饸억�䥐捦⇧濡醉ﾮꮝ讀棎틂䪧䂆,Quasar.Common.Messages.GetSystemInfo) at 1ae8b0e8c75365c47271340258db93e0-60001d2-_~Execute","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n \"SELECT * FROM Win32_BIOS\" (Indicator: \" win32_bios\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n \"SELECT * FROM Win32_BaseBoard\" (Indicator: \" win32_baseboard\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n \"SELECT * FROM Win32_Processor\" (Indicator: \" win32_process\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n \"Select * From Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n \"SELECT * FROM Win32_OperatingSystem WHERE Primary='true'\" (Indicator: \" win32_operatingsystem\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"54/72 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"uob@up.v\"\n Pattern match: \"ueu@up.v\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"MSSafetyScanner.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\SubDir\\MSSafetyScanner.exe]- [targetUID: 00000000-00000900]\n \"MSSafetyScanner.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$3d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$3e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%APPDATA%\\SubDir\\MSSafetyScanner.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessesByName(System.String) at 1ae8b0e8c75365c47271340258db93e0-600003f-_~_\n System.Diagnostics.Process::GetProcessById(System.Int32) at 1ae8b0e8c75365c47271340258db93e0-60001e4-_~_\n System.Diagnostics.Process::GetProcessById(System.Int32) at 1ae8b0e8c75365c47271340258db93e0-60001de-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyState(System.Int32) at 1ae8b0e8c75365c47271340258db93e0-600091c-KeyEventArgsExt~CheckModifier\n Gma.System.MouseKeyHook.Implementation.KeyboardState::GetKeyState(System.Windows.Forms.Keys) at 1ae8b0e8c75365c47271340258db93e0-60009e8-KeyboardState~IsDownRaw\n Gma.System.MouseKeyHook.Implementation.KeyboardState::GetKeyState(System.Windows.Forms.Keys) at 1ae8b0e8c75365c47271340258db93e0-60009e9-KeyboardState~IsToggled\n Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::MapVirtualKeyEx(System.Int32,System.Int32,System.IntPtr) at 1ae8b0e8c75365c47271340258db93e0-600097c-KeyboardNativeMethods~TryGetCharFromKeyboardState\n Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardState(System.Byte[]) at 1ae8b0e8c75365c47271340258db93e0-60009e5-KeyboardState~GetCurrent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n Found string \"hostname\" (Indicator: \"hostname\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")\n Found string \"/K CHCP {0}\" (Indicator: \"chcp\"; File: \"1AE8B0E8C75365C47271340258DB93E0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"1AE8B0E8C75365C47271340258DB93E0.exe\" opened \"C:\\1AE8B0E8C75365C47271340258DB93E0.exe:Zone.Identifier\" with delete access\n \"1AE8B0E8C75365C47271340258DB93E0.exe\" opened \"\\Device\\HarddiskVolume2\\1AE8B0E8C75365C47271340258DB93E0.exe:ZONE.IDENTIFIER\" with delete access\n \"MSSafetyScanner.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\MSSafetyScanner.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DeleteDC\" (Source: 1AE8B0E8C75365C47271340258DB93E0.exe, API is part of module: GDI32.DLL)\n Found string \"CryptHashData\" (Source: 1AE8B0E8C75365C47271340258DB93E0.exe, API is part of module: CRYPTSP.DLL)\n Found string \"GetCurrentThreadId\" (Source: 1AE8B0E8C75365C47271340258DB93E0.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetWindowThreadProcessId\" (Source: 1AE8B0E8C75365C47271340258DB93E0.exe, API is part of module: USER32.DLL)\n Found string \"shutdown\" (Source: 1AE8B0E8C75365C47271340258DB93E0.exe, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"1AE8B0E8C75365C47271340258DB93E0.exe\" opened \"C:\\1AE8B0E8C75365C47271340258DB93E0.exe:Zone.Identifier\" with delete access\n \"1AE8B0E8C75365C47271340258DB93E0.exe\" opened \"\\Device\\HarddiskVolume2\\1AE8B0E8C75365C47271340258DB93E0.exe:ZONE.IDENTIFIER\" with delete access\n \"MSSafetyScanner.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\MSSafetyScanner.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"54/72 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"54/72 Antivirus vendors marked dropped file \"MSSafetyScanner.exe\" as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 75% detection rate)\n 54/72 Antivirus vendors marked dropped file \"MSSafetyScanner.exe.bin\" as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 75% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"54/72 Antivirus vendors marked spawned process \"MSSafetyScanner.exe\" (PID: 900) as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 75% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"MSSafetyStartup\" /sc ONLOGON /tr \"%APPDATA%\\\\SubDir\\\\MSSafetyScanner.exe\" /rl HIGHEST /f\" (UID: 00000000-00000584)\n Process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"MSSafetyStartup\" /sc ONLOGON /tr \"%APPDATA%\\\\SubDir\\\\MSSafetyScanner.exe\" /rl HIGHEST /f\" (UID: 00000000-00002656)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"1AE8B0E8C75365C47271340258DB93E0.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 600)\n \"1AE8B0E8C75365C47271340258DB93E0.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 600)\n \"1AE8B0E8C75365C47271340258DB93E0.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 600)\n \"MSSafetyScanner.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 624)\n \"MSSafetyScanner.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 624)\n \"MSSafetyScanner.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 624)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"6000217-_~_\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"MSSafetyScanner.exe.bin\" as \"Detects Quasar infostealer\" (Author: ditekshen)\n YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"MSSafetyScanner.exe\" as \"Detects Quasar infostealer\" (Author: ditekshen)\n YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"sample.bin\" as \"Detects Quasar infostealer\" (Author: ditekshen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"{0}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe\n \"{0}\\FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 1AE8B0E8C75365C47271340258DB93E0.exe\n \"{0}\\\\FileZilla\\\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 600007d-ctor\n \"{0}\\\\FileZilla\\\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 600007d-ctor","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp, 00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp, 00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp, 00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp\n 00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)\" (SID: 2037042, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$42","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp, 00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"103.168.19.82:4782\"\n \"23.44.229.238:80\"\n \"108.181.47.111:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp, 00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp, 00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00005420-00000BC0-51242403]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ipwho.is\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"MSSafetyScanner.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005420.00000000.67482.1D3D2000.00000004.mdmp, 00000000-00005420.00000002.71323.1D3D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"MSSafetyScanner.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005628)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"1AE8B0E8C75365C47271340258DB93E0.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\1AE8B0E8C75365C47271340258DB93E0.exe.log\"\n \"1AE8B0E8C75365C47271340258DB93E0.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\1AE8B0E8C75365C47271340258DB93E0.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS webserver (GET/POST requests)","description":"Found requests in header \"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005628-00000C26-204841537\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005628-00000C26-210290198\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005628-00000C26-210614850\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005628-00000C26-210614987\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005628-00000C26-211898332\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$43","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$44","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")\n Found string \"HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 20:37:32 GMTContent-Type: application/json; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveServer: ipwhoisAccess-Control-Allow-Headers: *X-Robots-Tag: noindex\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\n Host: ipwho.is\n Connection: Keep-Alive","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://ipwho.is/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"108.181.47.111\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"schtasks.exe\" called \"GetComputerNameW\" (UID: 00000000-00001116)\n \"MSSafetyScanner.exe\" called \"GetComputerNameW\" (UID: 00000000-00005628)\n \"schtasks.exe\" called \"GetComputerNameW\" (UID: 00000000-00006968)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"MSSafetyScanner.exe\" called \"GetUserNameW\" (UID: 00000000-00005628)\n \"MSSafetyScanner.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"MSSafetyScanner.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"$45","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)\" (SID: 2037042, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"MSSafetyScanner.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"MSSafetyScanner.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 23.44.229.238 on port 80 is sent without HTTP header\n TCP traffic to 108.181.47.111 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"1AE8B0E8C75365C47271340258DB93E0.exe\" marked \"C:\\1AE8B0E8C75365C47271340258DB93E0.exe:Zone.Identifier\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"MSSafetyScanner.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"MSSafetyScanner.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00005628]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 9D210000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 103.168.19.82 on port 4782","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":24,"imported_dlls_count":118,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","opensource","quasar","rat","targeted","infostealer","njrat","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files","Network Traffic","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6564fce7dcb4abe9450431e6","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.PasswordStealerA","submit_name":"1AE8B0E8C75365C47271340258DB93E0.exe","analysis_start_time":"2023-11-27T20:32:39+00:00","indicators_count":{"informative":91,"suspicious":30,"malicious":11},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6564fcbb6981d19fe70bfa19","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.PasswordStealerA","contacted_countries":["CAN","IND","USA"],"submit_name":"1AE8B0E8C75365C47271340258DB93E0.exe","analysis_start_time":"2023-11-27T20:31:56+00:00","indicators_count":{"informative":107,"suspicious":45,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"103.168.19.82","port":4782,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"address":"23.44.229.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"address":"108.181.47.111","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]}],"dns_resolutions":[{"domain":"ipwho.is","address":"108.181.47.111","ttl":60,"country":"Canada","registrar_name_servers":"ns1.zilore.net","registrar_creation_date":"2020-06-08T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}],"processes":[{"pid":2560,"ppid":0,"name":"1AE8B0E8C75365C47271340258DB93E0.exe","command_line":"","sha256":"df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683","normalized_path":"C:\\1AE8B0E8C75365C47271340258DB93E0.exe","uid":"00000000-00002560","icon":"$48"},{"pid":584,"ppid":2560,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"MSSafetyStartup\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\MSSafetyScanner.exe\" /rl HIGHEST /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002560","uid":"00000000-00000584"},{"pid":900,"ppid":0,"name":"MSSafetyScanner.exe","command_line":"","sha256":"df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683","normalized_path":"%APPDATA%\\SubDir\\MSSafetyScanner.exe","uid":"00000000-00000900","icon":"$49"},{"pid":2656,"ppid":900,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"MSSafetyStartup\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\MSSafetyScanner.exe\" /rl HIGHEST /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00000900","uid":"00000000-00002656"}],"all_imported_dlls":["rpcss.dll","shell32.dll","dwmapi.dll","ws2_32.dll","rpcrt4.dll","mscorlib.ni.dll","cryptnet.dll","certcli.dll","RpcRtRemote.dll","imm32.dll","System.Configuration.ni.dll","crypt32.dll","Wldap32.dll","dsrole.dll","xmllite.dll","ucrtbase_clr0400.dll","gdi32.dll","lpk.dll","clbcatq.dll","advapi32.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Windows.Forms.dll","vcruntime140_clr0400.dll","bcrypt.dll","SensApi.dll","api-ms-win-core-synch-l1-2-0.dll","mscoreei.dll","clrjit.dll","cryptsp.dll","msasn1.dll","kernel32.dll","KernelBase.dll","sechost.dll","ole32.dll","cryptbase.dll","psapi.dll","usp10.dll","rsaenh.dll","apphelp.dll","ktmw32.dll","System.Windows.Forms.ni.dll","VxSSL32.dll","nsi.dll","msctf.dll","System.Drawing.ni.dll","System.Core.ni.dll","System.Xml.ni.dll","comctl32.dll","ntdll.dll","msvcrt.dll","user32.dll","uxtheme.dll","oleaut32.dll","nlssorting.dll","profapi.dll","mscoree.dll","shlwapi.dll","atl.dll","version.dll","System.ni.dll","sspicli.dll","taskschd.dll","fltLib.dll","clr.dll","System.Management.ni.dll","VxSSL64.dll","propsys.dll","rtutils.dll","ncrypt.dll","dhcpcsvc.dll","OnDemandConnRouteHelper.dll","kernel.appcore.dll","webio.dll","mswsock.dll","mskeyprotect.dll","winhttp.dll","WMINet_Utils.dll","combase.dll","ucrtbase.dll","msvcp110_win.dll","rasadhlp.dll","fastprox.dll","gpapi.dll","wbemcomn.dll","wbemprox.dll","wbemsvc.dll","secur32.dll","windows.storage.dll","msvcp_win.dll","MrmCoreR.dll","IPHLPAPI.DLL","rasapi32.dll","thumbcache.dll","ncryptsslp.dll","cabinet.dll","gdi32full.dll","powrprof.dll","WindowsCodecs.dll","policymanager.dll","schannel.dll","ntmarta.dll","wmiutils.dll","SHCore.dll","System.Runtime.Serialization.ni.dll","winnsi.dll","dnsapi.dll","win32u.dll","cfgmgr32.dll","cldapi.dll","aepic.dll","System.ServiceModel.ni.dll","dhcpcsvc6.dll","FWPUCLNT.DLL","bcryptprimitives.dll","iertutil.dll","Accessibility.ni.dll","ntasn1.dll","rasman.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"MSSafetyScanner.exe","sha256":"df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"MSSafetyScanner.exe.bin","sha256":"df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"1AE8B0E8C75365C47271340258DB93E0.exe.log","sha256":"f30b02b0b2de13d67f64c21a962271dfe6a1349695ee4820c870e450c1341c19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"},{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\1AE8B0E8C75365C47271340258DB93E0.exe.log","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\AUTOENROLLMENT\\","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\36273c21-280f-473d-aa8f-af6b17aef827","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"name":"Local\\36273c21-280f-473d-aa8f-af6b17aef827","sources":[{"report_type":"sandbox","report_id":"6564fce7dcb4abe9450431e6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5628:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6564fcbb6981d19fe70bfa19"}]}]}},"report_ids":{"sandbox_job_ids":["6564fce7dcb4abe9450431e6","6564fcbb6981d19fe70bfa19"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious MSIL.PasswordStealerA.Generic Sample df9104032c91… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample df9104032c91…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL.PasswordStealerA.Generic Sample df9104032c91… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample df9104032c91…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/df9104032c91e415db6acc7e364edd70cd1a2b436beb738af5286770c374a683"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL.PasswordStealerA.Generic Sample df9104032c91… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample df9104032c91…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4a","11",{}]]