26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample e5525c0cc38c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e5525c0cc38c…. Malware family: Trojan.Generic. Threat score 100/100. 8/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e5525c0cc38c18efafa4e48acd35b106ee0debd8c4ab1f45c6e64866ba8b6dbb","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","e5525c0cc38c18efafa4e48acd35b106ee0debd8c4ab1f45c6e64866ba8b6dbb"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"e5525c0cc38c18efafa4e48acd35b106ee0debd8c4ab1f45c6e64866ba8b6dbb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp")28:T7af,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "Oid"; Source: "00000000-00003108.00000001.65754.030D0000.00000002.mdmp")29:T1e11,Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2a:Teb6,"file.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003108) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003108) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000b46c40e58b0166ffcc0499ffff04ccffff0430e58b010000b46c0000000001000000 (UID: 00000000-00003108) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e1890a1e2e0eb8b012a9dfb7600000000248310770400000000000000000000005cfd8b0100000000e79cfb7602000780f4e58b01000000001600000044e68b01feffffffcce58b01cf003977d60039771ae2c476160000000b00000044e68b016f006e00a0e58b016e00740008e68b01 (UID: 00000000-00003108) "file.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003108) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000074db6901000000000600000000006169a0db690102000040a4dd6901a4dd69011a123a77000000008cdb690100000000a881280002033a770002000088013a7700000000e8dd6901a4013a770000000000000000000000015500530045005200330032002e0064006c006c00000000000000000000003377000033770000000052dc6901d000337774db690150dc69019cdc690195e134773e0f7700fefffffff5f6387716f83877d01c260052dc690148dc690048dc690101000000acdc69019ef83877626f387764f838777adb2676741261690cdd69010000000000003377 (UID: 00000000-00003108)2b:Tcd1,"file.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\\mscoreeis.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003108) "file.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003108)2c:T2350,"file.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003108) "file.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003108)2d:Td47,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")2e:T5cf1,Found reference to API (Indicator: "EncodePointer"; File: "file") Found reference to API (Indicator: "DecodePointer"; File: "file") Found reference to API (Indicator: "FlsFree"; File: "file") Found reference to API (Indicator: "FlsSetValue"; File: "file") Found reference to API (Indicator: "FlsGetValue"; File: "file") Found reference to API (Indicator: "FlsAlloc"; File: "file") Found reference to API (Indicator: "GetProcessWindowStation"; File: "file") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "file") Found reference to API (Indicator: "GetLastActivePopup"; File: "file") Found reference to API (Indicator: "GetActiveWindow"; File: "file") Found reference to API (Indicator: "MessageBoxA"; File: "file") Found reference to API (Indicator: "AddAtomW"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "lstrlenW"; File: "file") Found reference to API (Indicator: "VirtualProtect"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "VirtualAlloc"; File: "file") Found reference to API (Indicator: "GetModuleHandleA"; File: "file") Found reference to API (Indicator: "FreeConsole"; File: "file") Found reference to API (Indicator: "RtlUnwind"; File: "file") Found reference to API (Indicator: "GetCommandLineA"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "TlsGetValue"; File: "file") Found reference to API (Indicator: "TlsAlloc"; File: "file") Found reference to API (Indicator: "TlsSetValue"; File: "file") Found reference to API (Indicator: "TlsFree"; File: "file") Found reference to API (Indicator: "InterlockedIncrement"; File: "file") Found reference to API (Indicator: "SetLastError"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "InterlockedDecrement"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetStdHandle"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "file") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "file") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "WideCharToMultiByte"; File: "file") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "SetHandleCount"; File: "file") Found reference to API (Indicator: "GetFileType"; File: "file") Found reference to API (Indicator: "GetStartupInfoA"; File: "file") Found reference to API (Indicator: "DeleteCriticalSection"; File: "file") Found reference to API (Indicator: "HeapCreate"; File: "file") Found reference to API (Indicator: "VirtualFree"; File: "file") Found reference to API (Indicator: "HeapFree"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "RaiseException"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "IsDebuggerPresent"; File: "file") Found reference to API (Indicator: "LeaveCriticalSection"; File: "file") Found reference to API (Indicator: "EnterCriticalSection"; File: "file") Found reference to API (Indicator: "GetCPInfo"; File: "file") Found reference to API (Indicator: "GetACP"; File: "file") Found reference to API (Indicator: "GetOEMCP"; File: "file") Found reference to API (Indicator: "IsValidCodePage"; File: "file") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "file") Found reference to API (Indicator: "HeapAlloc"; File: "file") Found reference to API (Indicator: "HeapReAlloc"; File: "file") Found reference to API (Indicator: "GetLocaleInfoA"; File: "file") Found reference to API (Indicator: "GetStringTypeA"; File: "file") Found reference to API (Indicator: "MultiByteToWideChar"; File: "file") Found reference to API (Indicator: "GetStringTypeW"; File: "file") Found reference to API (Indicator: "LCMapStringA"; File: "file") Found reference to API (Indicator: "LCMapStringW"; File: "file") Found reference to API (Indicator: "HeapSize"; File: "file") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "file") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003108.00000000.65434.00260000.00000004.mdmp, 00000000-00003108.00000001.65754.00260000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "AddAtomW"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.030D0000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003108.00000000.65434.00410000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp, 00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "QueryDosDevice"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00003108.00000000.65434.00413000.00000004.mdmp, 00000000-00003108.00000001.65754.00172000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API (Indicator: "CoMarshalInterface"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00003108.00000001.65754.69701000.00000020.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "RpcRaiseException"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "NdrStubCall2"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "NdrOleFree"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "NdrGetUserMarshalInfo"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "NdrOleAllocate"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp") Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003108.00000001.65754.69740000.00000002.mdmp")2f:T4df,"\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "Local\!BrowserEmulation!SharedMemory!Mutex" "IsoScope_bec_IESQMMUTEX_0_519" "IsoScope_bec_IESQMMUTEX_0_331" "Local\ZonesCacheCounterMutex" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "IsoScope_bec_IE_EarlyTabStart_0xabc_Mutex" "IsoScope_bec_IESQMMUTEX_0_303" "Local\VERMGMTBlockListFileMutex" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3052" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "Local\ZonesLockedCacheCounterMutex" "UpdatingNewTabPageData" "IsoScope_bec_ConnHashTable<3052>_HashTable_Mutex" "Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\IsoScope_bec_IESQMMUTEX_0_519" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3052" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_bec_IE_EarlyTabStart_0xabc_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_bec_ConnHashTable<3052>_HashTable_Mutex"30:T502,Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_file.ex") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_file.ex") Found string "" (Indicator: "github.com")32:Tf52,"GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 121915 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 04 Dec 2023 22:41:10 GMT Etag: "614b5ba7-243" expires: Wed 06 Dec 2023 22:41:10 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4242 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 04 Dec 2023 22:41:12 GMT Last-Modified: Mon 04 Dec 2023 21:30:30 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 499 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 04 Dec 2023 22:41:20 GMT Last-Modified: Mon 04 Dec 2023 22:33:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2127 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 04 Dec 2023 22:41:55 GMT Last-Modified: Mon 04 Dec 2023 22:06:28 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3055 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 04 Dec 2023 22:41:56 GMT Last-Modified: Mon 04 Dec 2023 21:51:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4509 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 04 Dec 2023 22:41:57 GMT Last-Modified: Mon 04 Dec 2023 21:26:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......33:Tb3d,"file.exe" loaded module "MSCOREE.DLL" at base 69570000 "file.exe" loaded module "ADVAPI32.DLL" at base 755a0000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72b60000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "file.exe" loaded module "KERNEL32" at base 75ac0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 694e0000 "file.exe" loaded module "SHLWAPI.DLL" at base 76a70000 "file.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MUI\0409\\MSCOREEIS.DLL" at base 0 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEIS.DLL" at base 6e1c0000 "file.exe" loaded module "USER32.DLL" at base 759f0000 "file.exe" loaded module "IMM32.DLL" at base 77550000 "file.exe" loaded module "COMCTL32.DLL" at base 69610000 "file.exe" loaded module "USER32" at base 759f0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73cb0000 "file.exe" loaded module "DWMAPI.DLL" at base 73d00000 "file.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76da0000 "file.exe" loaded module "CRYPTBASE.DLL" at base 75130000 "file.exe" loaded module "KERNEL32.DLL" at base 75ac0000 "file.exe" loaded module "CLBCATQ.DLL" at base 774c0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75650000 "file.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "file.exe" loaded module "OLEAUT32.DLL" at base 75c00000 "file.exe" loaded module "SHELL32.DLL" at base 75cb0000 "file.exe" loaded module "OLE32.DLL" at base 76da0000 "file.exe" loaded module "COMCTL32.DLL" at base 740b0000 "file.exe" loaded module "APPHELP.DLL" at base 750e0000 "file.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 69700000 "file.exe" loaded module "PROPSYS.DLL" at base 73d90000 "file.exe" loaded module "IERTUTIL.DLL" at base 76f00000 "file.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 754a0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75ac0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6cb40000 "file.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 754b0000 "file.exe" loaded module "URLMON.DLL" at base 771e0000 "file.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6c8a0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d90000 "file.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75cb0000 "file.exe" loaded module "SETUPAPI.DLL" at base 75850000 "file.exe" loaded module "RPCRT4.DLL" at base 757a0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 750e000034:T64d,Found string "" (Indicator: "text/javascript"; File: "WHG8BZCB.htm") Found string "" (Indicator: "text/javascript"; File: "WHG8BZCB.htm") Found string "" (Indicator: "text/javascript"; File: "WHG8BZCB.htm") Found string "" (Indicator: "text/javascript"; File: "WHG8BZCB.htm") Found string "