24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample fc1e9a1378fd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fc1e9a1378fd…. Malware family: Trojan.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fc1e9a1378fdb34e8c938554eaa897134232b07e9401e60f0667dc119c3c2ed3","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","fc1e9a1378fdb34e8c938554eaa897134232b07e9401e60f0667dc119c3c2ed3"],"about":{"@type":"SoftwareApplication","name":"66c9d3f5503cc_GIFT.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"fc1e9a1378fdb34e8c938554eaa897134232b07e9401e60f0667dc119c3c2ed3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T87b,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.MemoryMarshal" and TypeReference "GetReference" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForLastWin32Error" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.MemoryMarshal" and TypeReference "Cast" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.MemoryMarshal" and TypeReference "AsRef" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.MemoryMarshal" and TypeReference "Read" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAuto" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "66c9d3f5503cc_GIFT.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "66c9d3f5503cc_GIFT.exe"26:Tf4a,Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "66c9d3f5503cc_GIFT.exe") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "66c9d3f5503cc_GIFT.exe") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp, 00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp, 00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp, 00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to "GPCVQQICUHWHKDFOQCNWITUXFCXHKMLFOFFH" (Indicator: "HKDF"; Source: "00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00003396.00000001.209313.002A0000.00000004.mdmp, 00000000-00003396.00000002.209556.002A0000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp")27:T852,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to encrypt data Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content)28:T784,"66c9d3f5503cc_GIFT.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003700000000000c2c3700000000008504000000000000682b370019040000b8083b000000000099040000000000008000000000000000000000000000000000000000000000000200000268923a00e62a00cc000000000000000000000000ff07000000000000e62a00ccb8083b000100000000000000020000000c000000f0df3a00f0df3a00ebdf3a0000000000000000000000370000000001e0f419000000000000fb190095e122777db13900feffffff435c26775059267794000000a0000000eadf3a00e8df3a009400000084f61900fdfe1777000000001800000072ecd57b (UID: 00000000-00002056)29:T242e,"66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100372c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a33393a31352e383733222c52583d302c50583d30003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100002400000002000000000000000000000072f82d001100000000000000000000002200000000000000000000000f00010e9ca3000e63006f006e00660069006700750072006100740069006f006e00000044006100740061005c004c006f00630061006c005c00500072006f0067007200 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000e8000000e80052750000000074e52000a0692a0040e6200095e12277989b2c007e000000000000003b2f3f77000052750000000000153272e800527503000000000000008800000095e12277f8e52000459d217600008b0000000000800000000200000000002100dc1a31720ce62000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006900630072006f0073006f00660074002000530069006c007600650072006c0069006700680074005c00780061007000610075007400680065006e007400690063006f00640065007300690070002e0064006c006c002e0032002e004d0061006e006900660065007300740000000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01aac6c08000000c41aac6c61f4289802000000d41cac6c00002100e616ac6c886f8b00786f8b0020d72000d0f0ad6ce0d7200053afad6cfd39a4f4feffffffc41aac6c421aac6ce616ac6c74d72000d91bac6ce616ac6c67c12176ae051c7574571c750000000000000000cc921875 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01aac6c08000000c41aac6c61f4289802000000d41cac6c0000210002000000000000008800000020d7200060d72000459d217600008b00000000008000000002000000000021009813b47174d72000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebdd754853c70400a0fd7f9a5c277700f0fd7f70b1200044a0fd7f00000000400000003f0000002600000000a0fd7f64b12000c15c277760822e772600000000a0fd7f9a5c277700f0fd7f88b120005789267780832e7713171975d8ebdd75 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031008d1cf0d005b29c5c753437586c0000000001000000000000000100000040f0d005000000006cf1d0057cf0d005d848cf044cf0d0058f9c5c753437586c0200000000000000180000000100000050f0d0052823d06900002a00000000000c000000c80fd2045cf0d0052f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000098d9380020000000000000002cee200050dcea7598d93800100000009cd93800000000001000000064ee20006eaaca6db8dcc96d458f19e9a8ef20000200000000000000180000009cd9380068ee20002823d06900002a00000000000c000000f826c46d74ee20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000090ef20006a6f9c683fe02d8804eb2000d132298a90f4200015de9b758bca90fdfeffffff7f67a375e2d86b75f010306dfe42306d4cef200002000000000000001800000044ef200050ef20002823d06900002a00000000000c00000030a5586c5cef20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006c68a4cf0400000000c0f20906984a056c68a4cf040cf30906d724046c68a4cf0420000000000000001c39046c2cf40906f0ead20400000000f0ead204020000000000000018000000f0ead20410f309062823d06900002a00000000000c000000f0ead2041cf309062f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000060b7d2042000000000000000f0ec200050dcea7560b7d2041000000064b7d204000000001000000028ed20006eaaca6db8dcc96d098c19e96cee200002000000000000001800000064b7d2042ced20002823d06900002a00000000000c000000f826c46d38ed20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000054ee20006a6f9c68f3e22d88c8e920001533298a90f4200015de9b758bca90fdfeffffff7f67a375e2d86b75f010306dfe42306d10ee200002000000000000001800000008ee200014ee20002823d06900002a00000000000c00000030a5586c20ee20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006cb0b7d2040000000070efd405984a056cb0b7d204bcefd405d724046cb0b7d20420000000000000001c39046cdcf0d405f01fd30400000000f01fd304020000000000000018000000f01fd304c0efd4052823d06900002a00000000000c000000f01fd304ccefd4052f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000060b7d2042000000000000000ecec200050dcea7560b7d2041000000064b7d204000000001000000024ed20006eaaca6db8dcc96d058c19e974ee200002000000000000001800000064b7d20428ed20002823d06900002a00000000000c000000f826c46d34ed20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000010000005cee20006a6f9c68cbe22d88d0e920001d33298a90f4200015de9b758bca90fdfeffffff7f67a375e2d86b75f010306dfe42306d18ee200002000000000000001800000010ee20001cee20002823d06900002a00000000000c00000030a5586c28ee20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006ca0b8d2040000000070ee1406984a056ca0b8d204bcee1406d724046ca0b8d20420000000000000001c39046cdcef14063030d304000000003030d3040200000000000000180000003030d304c0ee14062823d06900002a00000000000c0000003030d304ccee14062f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000098d938002000000000000000c4ec200050dcea7598d93800100000009cd938000000000010000000fcec20006eaaca6db8dcc96ddd8d19e94cee20000200000000000000180000009cd9380000ed20002823d06900002a00000000000c000000f826c46d0ced20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000034ee20006a6f9c6893e22d88a8e920007533298a90f4200015de9b758bca90fdfeffffff7f67a375e2d86b75f010306dfe42306df0ed2000020000000000000018000000e8ed2000f4ed20002823d06900002a00000000000c00000030a5586c00ee20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f00f00700000000008c47b77398bbd2048c47b7730000000098bbd20484e42000086d267718812e770000000038e5200000000000de549c68c4e4200095e122770bdb3900feffffff6b2c27773119197502100000000000000000010098e42000c89f26778c47b7730000000000000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006c98c0d2040000000000eeac06984a056c98c0d2044ceeac06d724046c98c0d20420000000000000001c39046c6cefac065066cf04000000005066cf040200000000000000180000005066cf0450eeac062823d06900002a00000000000c0000005066cf045ceeac062f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000060b7d204200000000000000080eb200050dcea7560b7d2041000000064b7d2040000000010000000b8eb20006eaaca6db8dcc96d998a19e9f8ec200002000000000000001800000064b7d204bceb20002823d06900002a00000000000c000000f826c46dc8eb20002f99586c0c000000 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000e0ec20006a6f9c684fe32d8854e82000a131298a90f4200015de9b758bca90fdfeffffff7f67a375e2d86b75f010306dfe42306d9cec200002000000000000001800000094ec2000a0ec20002823d06900002a00000000000c00000030a5586cacec20002f99586c0c000000 (UID: 00000000-00003396)2a:T7ca,"66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")2b:T887,"66c9d3f5503cc_GIFT.exe" queries volume information of "C:\66c9d3f5503cc_GIFT.exe" at 00000000-00002056-0000010C-3089137 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\66c9d3f5503cc_GIFT.exe" at 00000000-00003396-0000010C-3146164 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003396-0000010C-15423867 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003396-0000010C-15440025 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003396-0000010C-16916176 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003396-0000010C-16923560 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003396-0000010C-17849859 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00003396-0000010C-30967309 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00003396-0000010C-30986113 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00003396-0000010C-31195459 "66c9d3f5503cc_GIFT.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00003396-0000010C-312180442c:T7ec,"66c9d3f5503cc_GIFT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\66C9D3F5503CC_GIFT.EXE") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\66C9D3F5503CC_GIFT.EXE") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME")2d:T57d,"66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "66c9d3f5503cc_GIFT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB")2e:T5c49,"66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Microsoft Silverlight\xapauthenticodesip.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\b7ad5353ae4f44df28ce7ebc9a8a752a\System.Dynamic.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Google\Chrome\Application\chrome.exe (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\webengine4.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\webengine4.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00003396)2f:T101c2,"66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002056) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter MsiSIPIsMyTypeOfFile (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsFileSupportedName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PsIsMyFileType (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter XAP_IsFileSupportedName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PFXImportCertStore (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptEnumProvidersW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetProfileType (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetSidIdentifierAuthority (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptProtectData (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SystemFunction040 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertControlStoreW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertFindCertificateInStoreW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStoreW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipSetPixelOffsetMode (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CertSetCertificateContextProperty (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter InitializeLibrary (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost_RetAddr (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PerfCounterInitialize (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter MgdGetIISVersionInformation (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetDirMonConfiguration (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ZeroMemory (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ZeroMemoryA (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CryptUnprotectDataW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter __std_type_info_destroy_list (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter _free_base (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003396) "66c9d3f5503cc_GIFT.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003396)30:T1b2a,Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00002056.00000001.207159.005F0000.00000004.mdmp, 00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002056.00000001.207159.01DB0000.00000004.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00002056.00000001.207159.04C30000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003396.00000001.209313.04C70000.00000004.mdmp, 00000000-00003396.00000002.209556.04C70000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp, 00000000-00003396.00000002.209556.72FB1000.00000020.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "InsertMenuItem"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp, 00000000-00003396.00000002.209556.72FB1000.00000020.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadCursor"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp, 00000000-00003396.00000002.209556.72FB1000.00000020.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "InsertMenu"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateWindowEx"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003396.00000002.209556.00400000.00000040.mdmp")31:T4ca,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003396.00000001.209313.002A0000.00000004.mdmp 00000000-00003396.00000001.209313.04C70000.00000004.mdmp 00000000-00003396.00000002.209556.002A0000.00000004.mdmp 00000000-00003396.00000002.209556.04C70000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003396.00000001.209313.008D0000.00000002.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003396.00000001.209313.008D0000.00000002.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003396.00000001.209313.04C70000.00000004.mdmp 00000000-00003396.00000002.209556.04C70000.00000004.mdmp32:Tce3,"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib" in Source: 6001b90-PerformanceCounterLib~GetLanguageIds "SOFTWARE\\Microsoft\\.NETFramework" in Source: 6001bf9-NetFrameworkUtils~GetLatestBuildDllDirectory "%APPDATA%\Opera Software\Opera GX Stable\*" in Source: 00000000-00003396-00000C2B-71220331040 "%APPDATA%\Opera Software\Opera Stable\*" in Source: 00000000-00003396-00000C2B-71274358950 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00003396-00000C2B-71328431146 "%LOCALAPPDATA%\AVAST Software\Browser\User Data\*" in Source: 00000000-00003396-00000C2B-71351703378 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\*" in Source: 00000000-00003396-00000C2B-71363980702 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002056.00000001.207159.00370000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002056.00000001.207159.00370000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "SOFTWARE\MicrosoftX" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\DynamiD" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002056.00000001.207159.01DB0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003396.00000001.209313.002A0000.00000004.mdmp 00000000-00003396.00000002.209556.002A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003396.00000001.209313.002A0000.00000004.mdmp 00000000-00003396.00000002.209556.002A0000.00000004.mdmp "Read7HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00003396.00000001.209313.04680000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003396.00000002.209556.00400000.00000040.mdmp "Software\Valve\SteamLogin Data" in Source: 00000000-00003396.00000002.209556.00400000.00000040.mdmp33:T1028,"66c9d3f5503cc_GIFT.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "66c9d3f5503cc_GIFT.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135]34:T5b1,Observed unmanaged function "FormatMessageW" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "CreateFileMappingW" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "DuplicateHandle" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "FreeLibrary" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "GetComputerNameW" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "GetCurrentProcess" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "GetCurrentProcessId" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "GetProcessTimes" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "LoadLibrary" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "MapViewOfFile" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "OpenFileMappingW" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "OpenProcess" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "UnmapViewOfFile" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "VirtualQuery" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "WaitForSingleObject" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "RegCloseKey" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "RegQueryValueExW" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "ConvertStringSecurityDescriptorToSecurityDescriptor" in "66c9d3f5503cc_GIFT.exe" Observed unmanaged function "GetTokenInformation" in "66c9d3f5503cc_GIFT.exe"35:T398b,"66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70510000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "KERNEL32" at base 77130000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "ADVAPI32.DLL" at base 77080000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6a240000 "66c9d3f5503cc_GIFT.exe" loaded module "SHLWAPI.DLL" at base 75520000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "VERSION.DLL" at base 745b0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 69080000 "66c9d3f5503cc_GIFT.exe" loaded module "USER32.DLL" at base 75450000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "MSCOREE.DLL" at base 6c520000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "PSAPI.DLL" at base 75990000 "66c9d3f5503cc_GIFT.exe" loaded module "RPCRT4.DLL" at base 759a0000 "66c9d3f5503cc_GIFT.exe" loaded module "KERNEL32.DLL" at base 77130000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63e40000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "OLE32.DLL" at base 75580000 "66c9d3f5503cc_GIFT.exe" loaded module "CRYPTBASE.DLL" at base 75010000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 722d0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69cc0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68620000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 63620000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 68430000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 71b40000 "66c9d3f5503cc_GIFT.exe" loaded module "CRYPTSP.DLL" at base 74b20000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748b0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "BCRYPT.DLL" at base 74c30000 "66c9d3f5503cc_GIFT.exe" loaded module "NTDLL.DLL" at base 77210000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "SHELL32.DLL" at base 76430000 "66c9d3f5503cc_GIFT.exe" loaded module "AMSI.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 68260000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 627b0000 "66c9d3f5503cc_GIFT.exe" loaded module "NTDLL" at base 77210000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fc0000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75f00000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 688d0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62a30000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73070000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 721a0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 647f0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69680000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61bc0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "UXTHEME.DLL" at base 73c50000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 63fd0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69570000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 61440000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72330000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75f00000 "66c9d3f5503cc_GIFT.exe" loaded module "PROFAPI.DLL" at base 75130000 "66c9d3f5503cc_GIFT.exe" loaded module "COMCTL32.DLL" at base 74010000 "66c9d3f5503cc_GIFT.exe" loaded module "GDI32.DLL" at base 77400000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 69150000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 60800000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5f410000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69ca0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "DWRITE.DLL" at base 68790000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75180000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 68600000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6a070000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "CRYPT32.DLL" at base 751d0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "MSISIP.DLL" at base 73080000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 751d0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 72310000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 722d0000 "66c9d3f5503cc_GIFT.exe" loaded module "%PROGRAMFILES%\MICROSOFT SILVERLIGHT\XAPAUTHENTICODESIP.DLL" at base 72fb0000 "66c9d3f5503cc_GIFT.exe" loaded module "NCRYPT.DLL" at base 74c50000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 747f0000 "66c9d3f5503cc_GIFT.exe" loaded module "USERENV.DLL" at base 753a0000 "66c9d3f5503cc_GIFT.exe" loaded module "GPAPI.DLL" at base 746f0000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75f00000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75f00000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 68460000 "66c9d3f5503cc_GIFT.exe" loaded module "SXS.DLL" at base 75020000 "66c9d3f5503cc_GIFT.exe" loaded module "CLBCATQ.DLL" at base 75a50000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 71b40000 "66c9d3f5503cc_GIFT.exe" loaded module "RPCRTREMOTE.DLL" at base 750b0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76430000 "66c9d3f5503cc_GIFT.exe" loaded module "OLEAUT32.DLL" at base 75e60000 "66c9d3f5503cc_GIFT.exe" loaded module "LINKINFO.DLL" at base 6f9b0000 "66c9d3f5503cc_GIFT.exe" loaded module "PROPSYS.DLL" at base 73cd0000 "66c9d3f5503cc_GIFT.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77130000 "66c9d3f5503cc_GIFT.exe" loaded module "SETUPAPI.DLL" at base 75f20000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73cd0000 "66c9d3f5503cc_GIFT.exe" loaded module "NTMARTA.DLL" at base 74580000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DYNAMIC\B7AD5353AE4F44DF28CE7EBC9A8A752A\SYSTEM.DYNAMIC.NI.DLL" at base 69c30000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5f130000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5ee20000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6c5b0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 69090000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 69be0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "WS2_32.DLL" at base 75df0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74ae0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74640000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74ad0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "SECUR32.DLL" at base 74e40000 "66c9d3f5503cc_GIFT.exe" loaded module "SSPICLI.DLL" at base 74fa0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 682e0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6cce0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d990000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6c580000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d300000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6dc40000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "GDIPLUS.DLL" at base 73a00000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73a00000 "66c9d3f5503cc_GIFT.exe" loaded module "WINDOWSCODECS.DLL" at base 734c0000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 68200000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WEBENGINE4.DLL" at base 63f40000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WEBENGINE4.DLL" at base 63f40000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.WEB\V4.0_4.0.0.0__B03F5F7F11D50A3A\WEBENGINE4.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "WEBENGINE4.DLL" at base 63f40000 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "66c9d3f5503cc_GIFT.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 7235000036:T5d8,"66c9d3f5503cc_GIFT.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "66c9d3f5503cc_GIFT.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "66c9d3f5503cc_GIFT.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "66c9d3f5503cc_GIFT.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "66c9d3f5503cc_GIFT.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "66c9d3f5503cc_GIFT.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCSERVER32") "66c9d3f5503cc_GIFT.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "66c9d3f5503cc_GIFT.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "66c9d3f5503cc_GIFT.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "66c9d3f5503cc_GIFT.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "66c9d3f5503cc_GIFT.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")37:T103f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002056-00000C2B-262437400] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002056-00000C28-2234658464] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002056-00000C28-2235489207] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002056-00000C28-2235588221] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002056-00000C28-2236706004] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002056-00000C28-2236759664] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002056-00000C28-2236856776] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002056-00000C28-2238231138] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002056-00000C28-2238334125] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002056-00000C28-2238395232] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00002056-00000C28-2238668235] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002056-00000C28-2238804191] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002056-00000C28-2239158386] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002056-00000C28-2239423172] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002056-00000C28-2239616804] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002056-00000C28-2240049127] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002056-00000C28-2240173945] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002056-00000C28-2241078556] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002056-00000C28-2241409751] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00002056-00000C28-2241473840] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003396-00000C28-2249648732] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003396-00000C28-2250205910] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003396-00000C28-2250275802] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003396-00000C28-2251247601] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00003396-00000C28-2251373775]38:Tfcf,The input sample is signed with a certificate issued by "CN="<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<**********************************************************************************************************?????????????????????????????????????????????????????????????????????????????????????????????>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"" (SHA1: D0:06:CF:68:4F:B4:62:EA:D0:E4:C3:E1:62:CA:6F:EC:E8:3E:96:A7; see report for more information)39:T770,"66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "")3a:Tc3f,"66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "319DC449-ADA5-50F7-428E-957DB6791668"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "66C9D3F5503CC_GIFT"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "") "66c9d3f5503cc_GIFT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "CACHELOCATION"; Value: "")3b:T4b0,"66c9d3f5503cc_GIFT.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "66c9d3f5503cc_GIFT.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "66c9d3f5503cc_GIFT.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.v9921e851#\a891970b44db9e340c3ef3efa95b793c\microsoft.visualbasic.ni.dll.aux" "66c9d3f5503cc_GIFT.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "66c9d3f5503cc_GIFT.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "66c9d3f5503cc_GIFT.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "66c9d3f5503cc_GIFT.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "66c9d3f5503cc_GIFT.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux"3c:T535,"66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\FLTLIB.DLL" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "66c9d3f5503cc_GIFT.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "66c9d3f5503cc_GIFT.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"3d:T5fb,"66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\FLTLIB.DLL" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll"3e:T498,"66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\66c9d3f5503cc_GIFT.exe.config" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\jamCloud_wire\" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\66c9d3f5503cc_GIFT.INI" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\66C9D3F5503CC_GIFT.EXE.CONFIG" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\JAMCLOUD_WIRE" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\66C9D3F5503CC_GIFT.INI" "66c9d3f5503cc_GIFT.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"3f:T6ea,Potential IP "4.0.0.0" found in string "em.Runtime.Remoting,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "10.0.0.0" found in string "icrosoft.VisualBasic,10.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cult)" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cult" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, P" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Cult" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, p" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=n" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "=4.0.0.0" Potential IP "4.0.0.0" found in string "on=4.0.0.0," "192.168.0.2" "4.0.0.0000000" "1.1.0.5" "1.1.0.9" "4.0.0.0" "11.0.0.0" "116.9.50.7" "16.0.0.0" "16.3.0.0" Potential IP "4.0.0.0" found in string "ystem.Windows.Forms,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "em.Configuration,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neua" Potential IP "4.0.0.0" found in string "ternals,4.0.0.0,,31b" Potential IP "4.0.0.0" found in string "Services,4.0.0.0,,31" Potential IP "217.65.2.14" found in string "-proxy-server="217.65.2.14:3333"" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.15" "2.5.29.14" "2.5.29.10" "2.5.4.3" "2.5.29.1" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" "2.5.29.32" "2.5.29.16" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cu" Potential IP "0.0.0.0" found in string "0.0.0.0, Cul" Potential IP "217.65.2.14" found in string ""217.65.2.14:", "12.9.1.22", "1.1.21.1", "15.0.0.0"40:Tcc1,Heuristic match: "b+(o.pk" Heuristic match: "jamcloud_wire.my" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "bhttp type=system.se" Pattern match: "microsoft.net/assembly/" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://www.iec.ch" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "jamcloud_wire.re" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.visualbasic/v4.0_10.0.0.0__b03f5f7f11d50a3a/microsoft.visualbasic.dll" Heuristic match: "hnnrxj.my" Heuristic match: "k't" - Source: "00000000-00003396.00000001.209313.002A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnmn