34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 55:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T460,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample f7d07fcc5a05… — Score 70/100 — Hybrid Analysis","description":"Malicious verdict for sample f7d07fcc5a05…. Threat score 70/100. 0/25 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f"],"about":{"@type":"SoftwareApplication","name":"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f","applicationCategory":["peexe","assembly","executable"],"identifier":"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f","additionalType":"Malicious sample"},"threatScore":70,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta2d,Found reference to API "mailboxReceiveTimedOut" (Indicator: "time"; Source: "sample.bin"), Found reference to API "invokeAsync@133" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "downloadAsync@1804-1" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "downloadAsync@1802" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "RunSynchronously@1118-2" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "DragCapturedStateInfo" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "getRecordReader@450" (Indicator: "read"; Source: "sample.bin"), Found reference to API "beginRenameTab@79-10" (Indicator: "rename"; Source: "sample.bin"), Found reference to API "StaticPropSetOp" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "failedReadEnoughBytes" (Indicator: "read"; Source: "sample.bin"), Found reference to API "CreateDictionary@66-3" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "AsyncGetResponse@1786-5" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "bindA@727-1" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "PrintFormatToTextWriterThen@581" (Indicator: "write"; Source: "sample.bin"), Found reference to API "StaticFieldGetOp" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "AutoOpenAttribute" (Indicator: "open"; Source: "sample.bin"), Found reference to API "AutoOpenAttribute" (Indicator: "openat"; Source: "sample.bin"), Found reference to API "Could not convert string '{0}' to dictionary key type '{1}'. Create a TypeConverter to convert from the string to the key type object." (Indicator: "creat"; Source: "sample.bin"), Found reference to API "Can not create ListWrapper for type {0}." (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEvent@722-1" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEvent@722-1" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "Cross-thread calls are not allowed" (Indicator: "read"; Source: "sample.bin"), Found reference to API "IAsyncResult" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CreateDictionary@45" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "findOrCreate@101-1" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "AsyncRead@1730" (Indicator: "read"; Source: "sample.bin"), Found reference to API "AsyncRead@1730" (Indicator: "sync"; Source: "sample.bin")37:T1042,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLVERIFYREVOCATION") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CERTDLLVERIFYREVOCATION") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CERTDLLVERIFYREVOCATION\DEFAULT") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CERTDLLVERIFYREVOCATION\DEFAULT") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\TIMEVALIDDLLGETOBJECT") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\TIMEVALIDDLLGETOBJECT") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\URLDLLGETOBJECTURL") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\URLDLLGETOBJECTURL") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CHAINENGINE\CONFIG") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLENCODEOBJECTEX") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECTEX") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECTEX\1.2.840.113549.1.9.16.1.1") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECTEX\1.2.840.113549.1.9.16.1.1") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECTEX\1.2.840.113549.1.9.16.2.1") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECTEX\1.2.840.113549.1.9.16.2.1") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECTEX\1.2.840.113549.1.9.16.2.11") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECTEX\1.2.840.113549.1.9.16.2.11")38:T97a,Found XOR loop in file "sample.bin" at offset 1184381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1186937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1187153; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1188359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 267269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 452802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 453447; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 455792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 485493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 815063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 922757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 958067; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 961637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 967397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 971647; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 972427; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 973367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 974227; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1021356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1184848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1725468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1725480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1768128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1768140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1798524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1810560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1810572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1814928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1840692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2708092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2876034; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3042922; code bytes = 803039:T35be,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001c00150000006043210000000000150000000000000014000000000000000000000000000000000000000000000002000002202721007e00007e00000000000000000000000080000000000000009101009078f91f000100000000000000020000000c00000030982000309820002b982000000000000000000000001c0000000001a4f41200000000002cf6120095e12577b26b0200feffffff435c29775059297794000000a00000002a982000289820009400000060f61200fdfe9375c8f512001c2a5e695c0c0000e4f512002f2a5e6900000000000000000000000000000000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006491ba64000000006491ba640000000000f412009f4826776691ba640000000020f41200000000006691ba6424f412004da31a75000000000000000020f412006491ba6400000000000000000400000050f412000fa31a756491ba64020000000000000000000000080000006491ba64ffffffff0100008002000000a0f4120042a21a75e9fd0000080000006491ba64020000000000000001000000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000174000575c000000305f2100c4001c00020026001d00000000001c0000000000086d1c006cfb12000c00000038011c000000000000eb1f00f8691c00106b1c0068ff1f00f06d1c0002000000000000004800000070fb1200ecfa12002c48ae6400001c00000000004b48ae64681afa74010000002c8d046500000000605321005b5321000000000028fb12006017fd64ffffffff4b48ae64aa48ae6400001c00000000004000000034fb1200e543ae64c0a42000e848ae64b01bfa74010000002c8d046500000000cb000000020000005cfb1200a0fbfe64ffffffffe848ae64 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006b002000310000000000174000575c000000305f2100c4001c00020026001d00000000001c0000000000086d1c006cfb12000c00000038011c000000000000eb1f00f8691c00106b1c0068ff1f00f06d1c0002000000000000004800000070fb1200ecfa12002c48ae6400001c00000000004b48ae64681afa743f87ba64681afa74010000002c8d04650000000054fb120008fb12002876fa64ffffffff3f87ba645d87ba64901bfa74010000002c8d04650000000054fb120030fb12002877fa64ffffffff5d87ba647b87ba64b81bfa74010000002c8d04650000000054fb1200 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000020000100010088f912005cf912005cf9120024592a7700000000b8f912000cb7cc6488f9120006000000d4f912000c8726770000000002000000d4f91200626f2977348726774e80397714d5046572c693750000000001000100060000000000000008d50465f80a1c00a5d85e6950de046500000000bacb2bccb616f34c8990d74c2e8af5004e80397778f91200000000005cfb120095e1257722650200feffffff34872677c4b6cc644096cc64c0a42000fcb6cc640100000010fa1200d9b6cc641cd5046501000000c0a42000bcce93750000000000000000000000003cfb1200 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001c0015000000a86e210000000000150000000000000014000000000000000000000000000000000000000000000002000002e00c2000180000180000000000000000000000008000000000000000288000a8c06620000100000000000000020000000c00000030982000309820002b982000000000000000000000001c000000000140f51200000000005cfb120095e12577b26b0200feffffff435c29775059297794000000a00000002a9820002898200094000000e4f61200fdfe937564f612001c2a5e695c0c000080f612002f2a5e6900000000000000000000000000000000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000d2000000d20000000c000000083d230001000000020000000200000010000000d426046501000000383d046501000000c8f2120058f21200de44ae64202f220088f212009f44ae64b844ae640c12fa7498882000c8f21200010000000000000000000000a4f212001ce3fd64ffffffffb844ae647d44ae643412fa7498882000e8192300010000008a41b4647412fa74988820004060210000000000739fb3646c12fa74988820004060210000000000383d046500000000e1a7b3640000000098882000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000200000001b0075000100000000000000bceb00011c56297710992300086d1c00b8ea12002000000020ec120000000000b05c2300f8691c00186b1c00f0732300c06e1c003c6e29773ceb12000000000070ec1200f0732300e9e92977f073230000000000200000000000000000000000080000000200000030ec120072dc93750000000079dc93752cdfb14a38b119750000000000001775000000000000000084ec1200a8ec1200c715557600000000f0fe1f0000000000e8eb1200fceb12005ced120002000000000000002800000079dc937580ec1200c9761a75 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000110000004017930000009300e0179300000000003016806b000000003016806b000000006ceb12009f4826773216806b000000008ceb1200000000003216806b90eb12004da31a7500000000000000008ceb12003016806b000000000000000004000000bceb12000fa31a753016806b020000000000000000000000080000003016806bffffffff01000080020000000cec120042a21a75e9fd0000080000003016806b020000000000000001000000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000012007ce0120002000000020000000100420005000000000000000000000000000000e0e1120054772977bce012000000000014000000bf7729770000166800000000000080003ce11200f000166800000000000000000000000000000000000000000000000000000000000000001200140094e2120064e212000100000000000000ff2b2977ea9839770000000094011c0000001c001a983977c0711c680000ffff2400000000000000000000000800d4004401000001006e0024000000bce1120020000000086d1c0044010000010000000200000000000000a0ec1f00f8691c00 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001200702fd60050ea120080f49d750000d6000000000089f49d756c98bb4a02000000c4ea1200c0ea1200f4ea1200d0ea12002ef05900000000000000100014ea1200c83aa77588ea1200d58c9f75c4ea120058ea120042a49d75a802a77598ea1200d2f49d75080000006ef59d7544f59d75a498bb4a02000000ec36f975000013004548f9756cea12000200000000001300ec36f9759cea120042a49d75a802a775e0ea1200c035f975080000009535f9751511cd7402000000ec36f975000013004548f975882fd600702fd600acea1200e061fb756ceb12001ed8f9756dce2601 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000031003300650061003300350066006400660065003500310062003200350064003300350033003700660034003400360066003000390065003200660034003300360030003700390031003100300066002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b2977de903977d8eb5d76ac011c0000001c00000000000000000025004201588a39620000000000000000000000000000000026003d01588a39620000000000000000086d1c0000000000200000000000000000000000e8ca2500f8691c00186b1c00d8222800c06e1c00 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000ffffffffd8f112000000000000000000bcf11200d4f1120001000000000000000200000000000000000000002cf21200bb36b464c40300000400000000802e000000360500000000e936b464a812fa740200000094f21200000000004da01a75a401000024f212000cf21200180000000500000000802e000000000010732e000200000094f212000000000038f21200b0eab464800036050000000010732e0050f2120015eeb46480003605000036050000000010732e0070f2120007efb46480003605000036050000000010732e009046230000000000d4f21200e3ecb464 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000ea000000ea0000000c0000004826dd0401000000020000000200000010000000d426046501000000383d04650100000044cd1200d4cc1200de44ae64202f220004cd12009f44ae64b844ae64802dfa74d834dd0444cd120001000000000000000000000020cd12001ce3fd64ffffffffb844ae647d44ae64a82dfa74d834dd04c86edc04010000008a41b464e82dfa74d834dd04006d210000000000739fb364e02dfa74d834dd04006d210000000000383d046500000000e1a7b36400000000d834dd04 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000ca000000ca0000000c000000e00e250001000000020000000200000010000000d426046501000000383d046501000000d0ca120060ca1200de44ae64202f220090ca12009f44ae64b844ae64142afa745835dd04d0ca1200010000000000000000000000acca12001ce3fd64ffffffffb844ae647d44ae643c2afa745835dd04186edc04010000008a41b4647c2afa745835dd04a06c210000000000739fb364742afa745835dd04a06c210000000000383d046500000000e1a7b364000000005835dd04 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000002010000020100000c0000006010dc0401000000020000000200000010000000d426046501000000383d04650100000094da120024da1200de44ae64202f220054da12009f44ae64b844ae64d03afa745836dd0494da120001000000000000000000000070da12001ce3fd64ffffffffb844ae647d44ae64f83afa745836dd04b86cdc04010000008a41b464383afa745836dd04e06b210000000000739fb364303afa745836dd04e06b210000000000383d046500000000e1a7b364000000005836dd04 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000010007e0098e71200fadb5a6aa8e7120009275b6a04000000f0327e00b4e7120007235b6af0327e0010007e00d0e71200d7555b6af0327e000200000010007e00f0327e0000000000ece712005b555b6aece7120009275b6a04000000f0327e0002000000f8e71200fadb5a6a0400000018e81200c20a5b6a020000000e000000f0327e0010007e0000000000040000007ce81200ad265b6af0327e000000000040337e0010007e0000000000c8327e0001000000f0327e00020000001400000040327e0010007e000400000000000000000000001400000018337e0010007e00 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000120007235b6a843a7e00843a7e00bce71200dc2c5b6a843a7e000100000010007e00843a7e000a000000dce712002a285b6a843a7e000400000010007e00843a7e000000000001000000f8e71200d4275b6af8e7120009275b6a02000000843a7e000100000004e81200fadb5a6a0200000024e81200c20a5b6a010000000e000000843a7e0010007e00000000000200000088e81200ad265b6a843a7e0000000000fc3a7e0010007e0000000000ac3a7e0002000000843a7e00010000003f000000fc397e0010007e000400000000000000000000003f000000d43a7e0010007e00 (UID: 00000000-00003600)3a:Tf2e,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e0043006f006e0066006900670000000300000353b6000068ce2000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d506900009300000000006c6d50692924fa74d8d70465b0f51200acf5120000008f6b000000006cf5120000000000d8d7046504f5120080f5120074f51200b0f5120044f51200ff235069c83b596984f5120031175069080000001c5c287714a12977ffffffff240000006cf51200 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000001000000010000000000000000000000610033003500660000000000000000000000000000000000010000002f0000000000000000000000360066003000390065003200660034003300360000000000000031000000000000000000000000000000000000000000 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310075ccec1200502d1775f07323000000000000000000ecec12001c2d17750000177501000000000000000100000001000000010000000ced1200342917750000177501000000000000003cee120000000000010000000000000001000000000017750100000000000000000000002ced1200 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310069a0ec120031175069080000001c5c287714a12977ffffffff2400000088ec120004000000000000000100000034f9806b01000000d4ec1200935c2a7740833177d4a029774e9539770000000001000000010000009889200000000000a4ec12001bc6937510ed120095e12577627d0200 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000b00000024e2120030e2120002000000000000001000000014e2120030e21200c9761a7500001c0000001400da761a75f4deb14a000000000000166801000000935c2a77000000000000000000000000f8e1120001000000c8e41200bd061c75244ab93f00000000bd14166820132100 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5d76d82228000080fd7f9a5c2a7700f0fd7f04ea12004480fd7f00000000400000003f000000220000000080fd7ff8e91200c15c2a7760823177220000000080fd7f9a5c2a7700f0fd7f1cea1200578929778083317713171b75d8eb5d76 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47ba7378cbde048c47ba730000000078cbde0448d91200086d2977188131770000000038f52300000000006cf3fa6488d9120095e125775a680200feffffff6b2c2a7731191b750210000000000000000001005cd91200c89f29778c47ba730000000000000000 (UID: 00000000-00003600)3b:Td34,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")3c:T865,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3d:T36a1,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter RichEd20.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter mscorsec.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter imagehlp.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\ce3c98f2bf220ef17b0cf4233cac6ceb\System.Drawing.ni.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\367e5b8a038ac76eba17528bb7b3688e\System.Windows.Forms.ni.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\shlwapi.dll (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003600)3e:T15ac2,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetPublisher (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoInitializeEE (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoInitializeEE_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CORPolicyEE (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptSIPPutSignedDataMsg (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptSIPGetSignedDataMsg (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ImageGetCertificateData (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WVTAsn1SpcIndirectDataContentDecode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptSIPVerifyIndirectData (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WVTAsn1SpcPeImageDataDecode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoUninitializeEE (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoUninitializeEE_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilter (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterShellHookWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterShellHookWindowW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWindowsHookEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter UnregisterHotKey (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterHotKey (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CombineRgn (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetClassName (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWinEventHookW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter Shell_NotifyIcon (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter Shell_NotifyIconW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CallNextHookExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FindAtom (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FindAtomW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter AddAtom (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter AddAtomW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter TranslateMessageW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DispatchMessage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OleCreatePictureIndirect (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CopyImage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGraphicsClear (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateImageAttributes (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesColorKeys (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRectI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDisposeImageAttributes (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetPenDashStyle (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreatePath (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipAddPathLine2I (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateCustomLineCap (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetCustomLineCapWidthScale (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetPenCustomStartCap (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetPenCustomEndCap (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetScrollInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateStringFormat (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatAlign (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatTrimming (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NtGetCurrentProcessorNumber (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatLineAlign (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatHotkeyPrefix (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetStringFormatFlags (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetStringFormatFlags (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipMeasureString (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDeleteStringFormat (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetParent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetPageUnit (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsThemePartDefinedW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DrawThemeBackgroundW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipResetClip (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipResetWorldTransform (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipFillRectangleI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateRegionRectI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCombineRegionRectI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipSetClipRegion (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipTranslateClip (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetCurrentThemeNameW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipGetNearestColor (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateLineBrushFromRectI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDrawLineI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipFillRectanglesI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipCreateFromHWND (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GetThemePartSizeW (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter GdipDrawRectangleI (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00003600) "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003600)3f:T68a,"MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocHandler" in Source: 00000000-00003600.00000003.123081.00129000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003600.00000001.115545.001C0000.00000004.mdmp 00000000-00003600.00000002.117466.001C0000.00000004.mdmp 00000000-00003600.00000003.123081.001C0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\." in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting" in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger" in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003600.00000001.115545.03F20000.00000004.mdmp 00000000-00003600.00000002.117466.03F20000.00000004.mdmp 00000000-00003600.00000003.123081.03F20000.00000004.mdmp40:T7cb,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\shlwapi.dll" - [base:0; Status:c0000135]41:T9cc,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003600.00000001.115545.001C0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\." in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting" in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger" in Source: 00000000-00003600.00000001.115545.01E10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003600.00000001.115545.03F20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003600.00000002.117466.001C0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\." in Source: 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting" in Source: 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger" in Source: 00000000-00003600.00000002.117466.01E10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003600.00000002.117466.03F20000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocHandler" in Source: 00000000-00003600.00000003.123081.00129000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003600.00000003.123081.001C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003600.00000003.123081.03F20000.00000004.mdmp42:T25db,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "VERSION.DLL" at base 745e0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64ae0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "USER32.DLL" at base 773c0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "MSCOREE.DLL" at base 6b980000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "NTDLL" at base 77240000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "ADVAPI32.DLL" at base 764f0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "SHELL32.DLL" at base 765f0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "OLE32.DLL" at base 75dc0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "KERNEL32.DLL" at base 758f0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75480000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "PROFAPI.DLL" at base 75160000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 63fe0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "IMM32.DLL" at base 75f20000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "RICHED20.DLL" at base 68160000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORSEC.DLL" at base 6b800000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "MSCORSEC.DLL" at base 6b800000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "CRYPTSP.DLL" at base 74b50000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748e0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "CRYPTBASE.DLL" at base 75040000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "WINTRUST.DLL" at base 75170000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75300000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "IMAGEHLP.DLL" at base 75f90000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "NCRYPT.DLL" at base 74c80000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74820000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "BCRYPT.DLL" at base 74c60000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "USERENV.DLL" at base 75430000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "GPAPI.DLL" at base 74720000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75480000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "RPCRT4.DLL" at base 75840000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75480000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 70d40000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "CRYPTNET.DLL" at base 70d40000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "SENSAPI.DLL" at base 6bf20000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "SHLWAPI.DLL" at base 763b0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "WINHTTP.DLL" at base 70510000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "WS2_32.DLL" at base 764b0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "SSPICLI.DLL" at base 74fd0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "CREDSSP.DLL" at base 74810000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74b10000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "WSHTCPIP" at base 74670000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "WSHIP6.DLL" at base 74b00000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71890000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "IPHLPAPI.DLL" at base 734a0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "DHCPCSVC6.DLL" at base 733b0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "DHCPCSVC.DLL" at base 732d0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "NTDLL.DLL" at base 77240000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "NSI.DLL" at base 77390000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "CFGMGR32.DLL" at base 752d0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "OLEAUT32.DLL" at base 76410000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75480000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "DNSAPI.DLL" at base 749d0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74670000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74b00000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "RASADHLP.DLL" at base 718d0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75480000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 6a5a0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 63830000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\CE3C98F2BF220EF17B0CF4233CAC6CEB\SYSTEM.DRAWING.NI.DLL" at base 636a0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\367E5B8A038AC76EBA17528BB7B3688E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62ac0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73dc0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "GDI32.DLL" at base 75f40000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "DWMAPI.DLL" at base 73c10000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "UXTHEME.DLL" at base 73dc0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "GDIPLUS.DLL" at base 73a30000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73a30000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 758f0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6b8d0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "RPCRTREMOTE.DLL" at base 750e0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "WINDOWSCODECS.DLL" at base 734f0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "COMCTL32.DLL" at base 74010000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "OLEAUT32" at base 76410000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75dc0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 762e0000 "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" loaded module "CLBCATQ.DLL" at base 75a8000043:Tead,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00003600-00000C2B-256570975] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00003600-00000C2B-258046620] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll" [Source: 00000000-00003600-00000C2B-260438884] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00003600-00000C2B-261278992] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00003600-00000C2B-261907953] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00003600-00000C2B-263327129] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00003600-00000C2B-274589328] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00003600-00000C2B-275788089] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00003600-00000C2B-275952678] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\ce3c98f2bf220ef17b0cf4233cac6ceb\System.Drawing.ni.dll" [Source: 00000000-00003600-00000C2B-276079517] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\367e5b8a038ac76eba17528bb7b3688e\System.Windows.Forms.ni.dll" [Source: 00000000-00003600-00000C2B-276339987] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003600-00000C2B-276633574] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003600-00000C2B-278309900] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003600-00000C2B-278869980] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll" [Source: 00000000-00003600-00000C2B-279525276] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00003600-00000C2B-279785783] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll" [Source: 00000000-00003600-00000C2B-280964452] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00003600-00000C2B-281080937] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00003600-00000C2B-281194869] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" [Source: 00000000-00003600-00000C2B-281720478] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003600-00000C2B-282980154] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00003600-00000C2B-285639266] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll" [Source: 00000000-00003600-00000C2B-287229814] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003600-00000C2B-287852387] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00003600-00000C2B-288766058]44:T61c,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: ""; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E972-E325-11CE-BFC1-08002BE10318}"; Key: ""; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD"; Key: ""; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5C-36"; Key: ""; Value: "")45:T10bd,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")46:Tc22,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\FLTLIB.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\MSVCP140.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\VCRUNTIME140.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\ucrtbase.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL"47:T547,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch"48:Tde4,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\FLTLIB.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\MSVCP140.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\ucrtbase.DLL" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll"49:T6de,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe.config" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe.Local\" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}"4a:T637,"f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3f20048" "lpszHeaders": "If-None-Match: \"084627641cfd61:0\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT" "dwHeadersLength": "4294967295" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2ee7"} "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3f20e20" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2ee7"} "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4dc2f78" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2ee7"} "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3f2e300" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2ee7"} "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4dc5878" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2ee7"} "f7d07fcc5a050e84dcb392eb13ea35fdfe51b25d3537f446f09e2f436079110f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4dc5508" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2ee7"}4b:T8bd8,Found URL "https://secure.comodo.net/cps0a:08060http://crl.comodoca.com/comodocodesigningca2.crl0rf0d0<0http://crt.comodoca.com/comodocodesigningca2.crt0$http://ocsp.comodoca.com0,!maurice.flanagan@bemosoftware.com016:5!4nxu.j_dnamepropc\t41.3.6.1.4.1.311.64.1.10u2!7phy\dm0un0u0lj0u" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxp1<92a@ef" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9np1<92a@ef6" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'c/is!!0ikx-5o\salt" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c+9sgte" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa02.5.29.42.5.29.10929?q8" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0c[fd?bbmf89b$jd" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?us1!0the" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=suuuhhsmqdy32" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0$d.2c=mkrbf" - Source: "00000000-00003600.00000001.115545.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocodesigningca2.crl" - Source: "00000000-00003600.00000001.115545.03F20000.00000004.mdmp") Found URL "http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbrtl6lmy2%2bipob4twryif%2bffgudvwquk8ngq7ooywuqrtf5r8ri4uha%2flgcebbwnu%2f1vajxmgab2oqrdbs%3do" - Source: "00000000-00003600.00000001.115545.03F20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocodesigningca2.crlentssfully" - Source: "00000000-00003600.00000001.115545.03F20000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00003600.00000001.115545.03F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003600.00000001.115545.03F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0$d.2c=mkrbf" - Source: "00000000-00003600.00000001.115545.03F20000.00000004.mdmp") Found URL "https://secure.comodo.net/cps0a:08060http://crl.comodoca.com/comodocodesigningca2.crl0rf0d0<0http://crt.comodoca.com/comodocodesigningca2.crt0$http://ocsp.comodoca.com0,!maurice.flanagan@bemosoftware.com016:5!4nxu.j_dnamepropc\t41.3.6.1.4.1.311.64.1.10u2!7phy\dm0un0u0lj0u" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxp1<92a@ef" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9np1<92a@ef6" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'c/is!!0ikx-5o\salt" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c+9sgte" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa02.5.29.42.5.29.10929?q8" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0c[fd?bbmf89b$jd" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?us1!0the" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=suuuhhsmqdy32" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0$d.2c=mkrbf" - Source: "00000000-00003600.00000002.117466.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocodesigningca2.crl" - Source: "00000000-00003600.00000002.117466.03F20000.00000004.mdmp") Found URL "http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbrtl6lmy2%2bipob4twryif%2bffgudvwquk8ngq7ooywuqrtf5r8ri4uha%2flgcebbwnu%2f1vajxmgab2oqrdbs%3do" - Source: "00000000-00003600.00000002.117466.03F20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocodesigningca2.crlentssfully" - Source: "00000000-00003600.00000002.117466.03F20000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00003600.00000002.117466.03F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003600.00000002.117466.03F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0$d.2c=mkrbf" - Source: "00000000-00003600.00000002.117466.03F20000.00000004.mdmp") Found URL "https://secure.comodo.net/cps0a:08060http://crl.comodoca.com/comodocodesigningca2.crl0rf0d0<0http://crt.comodoca.com/comodocodesigningca2.crt0$http://ocsp.comodoca.com0,!maurice.flanagan@bemosoftware.com016:5!4nxu.j_dnamepropc\t41.3.6.1.4.1.311.64.1.10u2!7phy\dm0un0u0lj0u" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxp1<92a@ef" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9np1<92a@ef6" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'c/is!!0ikx-5o\salt" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c+9sgte" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa02.5.29.42.5.29.10929?q8" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0c[fd?bbmf89b$jd" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?us1!0the" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=suuuhhsmqdy32" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0$d.2c=mkrbf" - Source: "00000000-00003600.00000003.123081.001C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocodesigningca2.crl" - Source: "00000000-00003600.00000003.123081.03F20000.00000004.mdmp") Found URL "http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbrtl6lmy2%2bipob4twryif%2bffgudvwquk8ngq7ooywuqrtf5r8ri4uha%2flgcebbwnu%2f1vajxmgab2oqrdbs%3do" - Source: "00000000-00003600.00000003.123081.03F20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocodesigningca2.crlentssfully" - Source: "00000000-00003600.00000003.123081.03F20000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00003600.00000003.123081.03F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003600.00000003.123081.03F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0$d.2c=mkrbf" - Source: "00000000-00003600.00000003.123081.03F20000.00000004.mdmp")4c:T6a5,Found string "oviderName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003600.00000000.113623.001C0000.00000004.mdmp") Found string "