26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample feaa5822f2af… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample feaa5822f2af…. Malware family: Trojan.Generic. Threat score 100/100. 7/24 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/feaa5822f2af1ce3686d527d14877332c69ea565e2afcff25ef437e3b915e300","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","feaa5822f2af1ce3686d527d14877332c69ea565e2afcff25ef437e3b915e300"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["compressed","innosetup"],"identifier":"feaa5822f2af1ce3686d527d14877332c69ea565e2afcff25ef437e3b915e300","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":7,"total":24},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T889,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "file") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "file") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "file") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "file") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "file") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")28:T620,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "file") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000000.173792.05130000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")29:T7f8,"file.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "file.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "file.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "file.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "file.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "file.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "file.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32") "file.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32") "file.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32") "file.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32") "file.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "file.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "file.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32") "file.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32") "file.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32") "file.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32")2a:T990,"file.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-1669745198 [PID: 6116] "file.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-1669753275 [PID: 6116] "file.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-1669910300 [PID: 6116] "file.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-1669919327 [PID: 6116] "file.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-1670016477 [PID: 6116] "file.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-1670025194 [PID: 6116] "file.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-1670156746 [PID: 6116] "file.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-1670165718 [PID: 6116] "file.tmp" queried SystemProcessInformation at 00000000-00001156-00000C15-1671022598 [PID: 1156] "file.tmp" queried SystemProcessInformation at 00000000-00001156-00000C15-1671031694 [PID: 1156] "file.tmp" queried SystemProcessInformation at 00000000-00001156-00000C15-1671422782 [PID: 1156] "file.tmp" queried SystemProcessInformation at 00000000-00001156-00000C15-1671434218 [PID: 1156] "file.exe" queried SystemProcessInformation at 00000000-00002752-00000C15-1714163987 [PID: 2752] "file.exe" queried SystemProcessInformation at 00000000-00002752-00000C15-1714176757 [PID: 2752] "file.exe" queried SystemProcessInformation at 00000000-00002752-00000C15-1714325751 [PID: 2752] "file.exe" queried SystemProcessInformation at 00000000-00002752-00000C15-1714332817 [PID: 2752] "file.exe" queried SystemProcessInformation at 00000000-00002752-00000C15-1714428447 [PID: 2752] "file.exe" queried SystemProcessInformation at 00000000-00002752-00000C15-1714436166 [PID: 2752] "file.exe" queried SystemProcessInformation at 00000000-00002752-00000C15-1714564138 [PID: 2752] "file.exe" queried SystemProcessInformation at 00000000-00002752-00000C15-1714572400 [PID: 2752] "file.tmp" queried SystemProcessInformation at 00000000-00008108-00000C15-1715315709 [PID: 8108] "file.tmp" queried SystemProcessInformation at 00000000-00008108-00000C15-1715323592 [PID: 8108] "file.tmp" queried SystemProcessInformation at 00000000-00008108-00000C15-1715698326 [PID: 8108] "file.tmp" queried SystemProcessInformation at 00000000-00008108-00000C15-1715707206 [PID: 8108] "file.tmp" queried SystemProcessInformation at 00000000-00008108-00000C15-1717411215 [PID: 8108]2b:T10af,Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; File: "file") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; File: "file") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "file") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "file") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertFindChainInStore" (Indicator: "CertFindChainInStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp")2c:T821a,Found XOR loop in file "_isdecmp.dll" at offset 23985; code bytes = 30d0 Found XOR loop in file "_isdecmp.dll" at offset 26548; code bytes = 30d0 Found XOR loop in file "_isdecmp.dll" at offset 31004; code bytes = 30d0 Found XOR loop in file "_isdecmp.dll" at offset 34710; code bytes = 30d0 Found XOR loop in file "_isdecmp.dll" at offset 21811; code bytes = 8030 Found XOR loop in file "_isdecmp.dll" at offset 29612; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 64744; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 148881; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 180542; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 186805; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 269929; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 275058; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 312207; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 373315; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 385069; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 419920; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 433060; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 583616; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 655532; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 769695; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 800940; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 919625; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 919883; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 926100; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 972928; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 997361; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1041227; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1049522; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1066116; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1106845; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1177144; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1249195; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1316863; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1357644; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1417939; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1443820; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1450846; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1492308; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1661474; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1683297; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1707591; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1803161; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1807275; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1918892; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1938268; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1949178; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1977693; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2180225; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2191776; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2425761; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2584102; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2677834; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2682046; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2686853; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2715357; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2749666; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2869187; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2997837; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3037254; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3124319; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3202270; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3205507; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3220185; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3221905; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3518700; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3576500; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3678502; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3703992; code bytes = 30d0 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 46542; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 95660; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 224554; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 229049; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 230180; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 415614; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 641997; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 710448; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 805423; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 851160; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 861493; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 933512; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1020966; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1064380; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1075107; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1182619; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1194371; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1298087; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1460464; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1500077; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1657862; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1740894; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1897896; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1900182; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1908797; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1974306; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2050497; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2070952; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2095826; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2173121; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2182381; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2303255; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2387148; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2454773; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2588824; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2621188; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2626829; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2687463; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2765349; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2783646; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2838259; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2940685; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2998444; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3150492; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3176742; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3178153; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3305518; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3386604; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3408351; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3431092; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3465490; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3482608; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3494934; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3559480; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3619555; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3660573; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3681677; code bytes = 33c1 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 27522; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 104790; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 117056; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 273059; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 353351; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 368800; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 440144; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 452190; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 503896; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 512131; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 597820; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 666355; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 672452; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 698376; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 881632; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1015509; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1072380; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1080790; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1291827; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1294631; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1336808; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1469722; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1535408; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1541600; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1610843; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1654040; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1806304; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1946251; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 1965576; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2022415; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2090405; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2105750; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2130465; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2160612; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2168305; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2259457; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2326246; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2391445; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2489391; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2621036; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2755949; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2792068; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2852483; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2926969; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 2963689; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3000277; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3250207; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3258118; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3290437; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3293986; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3374501; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3431182; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3448139; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3488216; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3581923; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3645357; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3646626; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3675967; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3682376; code bytes = 8030 Found XOR loop in file "is-M4SLYOVDUR.tmp" at offset 3719640; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 27779; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 27794; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 27802; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 32649; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3166901; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3166960; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3166968; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3166979; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3172401; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3651324; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3655472; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3698984; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3700459; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3893252; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3922915; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3924367; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3925323; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3931541; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3932879; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3933045; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3939635; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3940329; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3942859; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3952387; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3959779; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3961037; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3972389; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3975797; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3983617; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3987071; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 3990937; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4002193; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4006789; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4011773; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4018027; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4022167; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4025633; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4026371; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4035343; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4036067; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4044199; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4049113; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4058659; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4062327; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4063551; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4064555; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4065659; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4066177; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4067267; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4077999; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4083631; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4094553; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4105507; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4117267; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4117889; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4122363; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4123011; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4128199; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4131875; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4133441; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4138789; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4139379; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4148999; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4153465; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4155667; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4157685; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4158403; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4160923; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4161635; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4164607; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4170849; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4171587; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4182451; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4186075; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4187279; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4188575; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4190657; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4191071; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4191789; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4199459; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4205405; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4207011; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4209051; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4211103; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4213123; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4215127; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4217159; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4219175; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4221081; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4224815; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4226135; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 4228227; code bytes = 30d0 Found XOR loop in file "file.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3123539; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3123572; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3123605; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3123638; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3123801; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3124043; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3192001; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3926239; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3939005; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3956099; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3961825; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3962555; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 3988267; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4002303; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4013729; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4017031; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4017529; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4025199; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4025723; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4058823; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4063637; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4087955; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4104497; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4113959; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4122459; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4124945; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 4144481; code bytes = 33c1 Found XOR loop in file "file.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 2948293; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 2970549; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 2983733; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3017542; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3027916; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3051755; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3283153; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3283171; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3339946; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3340311; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3402942; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3404540; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3404570; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3404590; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3463807; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3463870; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3463907; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3463925; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3464256; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3464274; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3471557; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3567988; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3916306; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3916846; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3918936; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3922896; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3923710; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3925310; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3927982; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3932178; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3935608; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3938296; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3939600; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3941774; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3942822; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3945012; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3951070; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3951406; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3959752; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3962382; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3967208; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3969310; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3971826; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3989444; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3990018; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3995004; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3996380; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3998582; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 3999624; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4000600; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4010532; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4011144; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4021192; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4023382; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4026332; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4028040; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4035304; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4036028; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4044168; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4053204; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4056760; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4058620; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4064544; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4065056; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4072324; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4079568; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4083620; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4085890; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4086556; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4099344; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4102586; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4105472; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4107632; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4110860; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4112902; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4113604; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4122344; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4128658; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4131086; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4148960; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4149518; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4152008; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4155628; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4158364; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4160884; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4166089; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4176112; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4185760; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4191032; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4191760; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4192340; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4193502; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4203242; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4206972; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4209012; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4211064; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4213084; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4215088; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4217120; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4219142; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4223996; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4224776; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4226116; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4228188; code bytes = 8030 Found XOR loop in file "file.tmp" at offset 4278314; code bytes = 8030 Found XOR loop in file "is-HMYQQLTWO6.tmp" at offset 733051; code bytes = 80302d:Ta87,Found string "C:\WINDOWS\system32\drivers\vmusbmouse.sys" (Source: "00000000-00001156.00000001.172949.03230000.00000004.mdmp, 00000000-00001156.00000001.172949.06410000.00000004.mdmp, 00000000-00001156.00000002.173488.06410000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmgencounter.sys" (Source: "00000000-00001156.00000001.172949.03230000.00000004.mdmp, 00000000-00001156.00000002.173488.03230000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmgid.sys" (Source: "00000000-00001156.00000001.172949.03230000.00000004.mdmp, 00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS\vm3dmp-stats.sys" (Source: "00000000-00001156.00000001.172949.06410000.00000004.mdmp, 00000000-00001156.00000002.173488.06410000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS\vm3dmp_loader.sys" (Source: "00000000-00001156.00000001.172949.06410000.00000004.mdmp, 00000000-00001156.00000002.173488.06410000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vms3cap.sys" (Source: "00000000-00001156.00000001.172949.06410000.00000004.mdmp, 00000000-00001156.00000002.173488.06410000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS\vm3dmp-debug.sys" (Source: "00000000-00001156.00000001.172949.06410000.00000004.mdmp, 00000000-00001156.00000002.173488.06410000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmstorfl.sys" (Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS\vm3dmp.sys" (Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmbus.sys" (Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\VMBusHID.sys" (Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS\vmmemctl.sys" (Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmmouse.sys" (Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmci.sys" (Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp")2e:T690,Found string "vmusbmouse" (Indicator: "vmusb"; Source: "00000000-00001156.00000001.172949.03230000.00000004.mdmp, 00000000-00001156.00000001.172949.06410000.00000004.mdmp, 00000000-00001156.00000002.173488.06410000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmusbmouse.sys" (Indicator: "vmusb"; Source: "00000000-00001156.00000001.172949.03230000.00000004.mdmp, 00000000-00001156.00000001.172949.06410000.00000004.mdmp, 00000000-00001156.00000002.173488.06410000.00000004.mdmp") Found string "VMMemCtl" (Indicator: "vmmemctl"; Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS\vmmemctl.sys" (Indicator: "vmmemctl"; Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "vmmouse" (Indicator: "vmmouse"; Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmmouse.sys" (Indicator: "vmmouse"; Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmci.sys" (Indicator: "\vmci"; Source: "00000000-00001156.00000001.172949.0657E000.00000004.mdmp, 00000000-00001156.00000002.173488.0657E000.00000004.mdmp") Found string "vmusbm" (Indicator: "vmusb"; Source: "00000000-00001156.00000002.173488.06410000.00000004.mdmp") Found string "\vmusbmo" (Indicator: "vmusb"; Source: "00000000-00001156.00000002.173488.06410000.00000004.mdmp")2f:T420,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "file") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")30:T5e7,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "file") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "file") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "file") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "file") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "file") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "file") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp, 00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")31:Te1b,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "file") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "file") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "file") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "file") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "file") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "file") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "file") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "file") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): LongInt;" (Indicator: "sendmessage"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): Boolean;" (Indicator: "postmessage"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp")32:T29b2,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006116) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006116) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006116) "file.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f4001c00000000c0c1760000c076800000000060060000100000200000000000000178bd840954020000c0fcf400e99c6877d035027418fcf4006fd7177780fcf400506a6a7714bd8409feffffff90fcf400e3e2177706000000c0fcf400f0d717778e098e43000000008036d8000000c075000000008036d800000000000000000058fcf400b0330274ecfcf400f0fb19774ed85834feffffffb8fcf40029a8fd7354020000acfcf4000c000000e99c687700000000080000000d00000000000000f8fcf40094bd840900000000f8fcf4008ff7fe730000000044f6bbe8819e9e00200d5205a9999e0001000000f8629e000000000066989e0010fdf400 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000520510f55205e05a4f0510f55200905b4f05e05a4f0500f65205e0f9f400a854b00018f55205b254b0003c01000090090a1d04faf40010f5520510f5520504faf40010f55205fcf9f4002b5eb000a0faf400405eb0004a5eb00000f6520500f652050cfdf400da60b00090090a1df4ffffff00000000000001085365676f65205549000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f65205 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000f486520508000000000000000000000000000000c4fcf40056b719770004000000010000f486520508000000f4865205080000003c010000f4fcf4000800000010000000f8fcf4004278a000f4865205080000005ef141ff7a6f9e00b9ad9e001cfdf4009c079f00f80fd9001cfdf4008b079f00f80fd90018fdf40013caab001dcaab00f0aea700681d5605a028510501000000f0aea70000000000a0bd51053bd5a8000200000000000000181c56058bdea800f0aea70011989e00a0bd5105379b9e00f0aea700a0bd5105939b9e00f0aea70006e4a80010e4a8000100000078fdf4007cfdf40026e4a800b841d800ee000000d741d800388ccb00 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028ba84090000000080fcf4003f8a67770000000001000000e0fbf400ffff00000c025305fb8c677700000000000000000c025305b0fcf4000000000000000000000000006febfe7309000000f0352303090000000c0253050000000070a21a7700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000bcbd8409b4fcf40011b9177700008a75a8fcf40000000000b0fcf400000000006febfe7300008a7520b1d6001c001d000c025305fcfc6977844f6e77b5000000f8fcf40004000000d0fcf4000c000000fcfcf400648607004c0102000000000000000000230000c06e4f6e773c01000070a21a77da4f6e77c4010000000000000c00000038bc840918fdf40083a21a77c401000017fdf400000000007cfdf400d6afd600c401000030fdf4004c0164866c875205000000000000a6730000a673000000006c8752050000000070fdf4002030b3737a6f9e00ddad9e006cfdf400 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000090bb8409e0faf40011b91777be186877ccbb8409682524030000000030fbf4006febfe73000000000000000018001900b8faf400b0558b7554fbf400506a6a77d4b6027efeffffffbe186877a24568776825240318e2230348fbf400682524036825240038fbf4000000000038fbf4006060687705000000c002da009b6f9e0030fbf400f4f1bbe8dcf6f40000000000a4fbf4008226017464834d9cfeffffff70fbf400a4d7c176e400030096040000112700000000000000000000b7020000e1d7c1769b0165438cfdf4000c47d600e40003009604000011270000 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000687738e3f400c8e2f40034e0687734f4f4000400000002000000842d9200080015c01403000000300601f0e2f4000060060114e3f4005261117450cb25034886297400000000e7a759f7cce3f400c79612740000000050cb25034886297401180000cce3f400d2961274d82f0b74501e1274f996127400000000d82f0b74fc1f26033ce4f40050cb2503000000007ce3f4003f108c75080015c090cc107401000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006a5e197748e4f400dbcc1074010000000000000004000000b2168e43 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000000d6860638cf67778c3923036cd6860601000000403923038c39230340392303040000000400000000e02377001000006cd686060100000040392303cd9767779c976777b099f60fb50f1a774039230300006777000000008c0c9d700000000080ee207701000000e9966677f8e2237700000000040000000000000048402277f8e2237770d6860680e8ec75e8a1230380e8ec756cd686060000000080e8ec757900730057004f005700360034000000c818517700263f731800000048db860604d786060301000078ea86065119517700000000000000000000000000000000ffffffff000000000000000000000000ee92640604936406 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000000d6860638cf67778c3923036cd6860601000000403923038c39230340392303040000000400000000e02377001000006cd686060100000040392303cd9767779c976777b099f60fb50f1a774039230300006777000000008c0c9d700000000080ee207701000000e9966677f8e2237700000000040000000000000048402277f8e2237770d6860680e8ec75e8a1230380e8ec756cd686060000000080e8ec757900730057004f005700360034000000c818517700263f731800000048db860604d786060301000078ea86065119517700000000000000000000000000000000ffffffff00000000000000000000000086da2d039eda2d03 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000000d6860638cf67778c3923036cd6860601000000403923038c39230340392303040000000400000000e02377001000006cd686060100000040392303cd9767779c976777b099f60fb50f1a774039230300006777000000008c0c9d700000000080ee207701000000e9966677f8e2237700000000040000000000000048402277f8e2237770d6860680e8ec75e8a1230380e8ec756cd686060000000080e8ec757900730057004f005700360034000000c818517700263f731800000048db860604d786060301000078ea86065119517700000000000000000000000000000000ffffffff0000000000000000000000008e062a03a2062a03 (UID: 00000000-00001156) "file.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000000d6860638cf67778c3923036cd6860601000000403923038c39230340392303040000000400000000e02377001000006cd686060100000040392303cd9767779c976777b099f60fb50f1a774039230300006777000000008c0c9d700000000080ee207701000000e9966677f8e2237700000000040000000000000048402277f8e2237770d6860680e8ec75e8a1230380e8ec756cd686060000000080e8ec757900730057004f005700360034000000c818517700263f731800000048db860604d786060301000078ea86065119517700000000000000000000000000000000ffffffff0000000000000000000000004e9f6406649f6406 (UID: 00000000-00001156)33:T45d,"file.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000b0aa62735c9a7c03489a7c03d02c943de8d8f40088f66373d4d9f400809d6273182b034efeffffff25a062733fa06273b0aa627350d9f4001f626273b0aa6273735f4f7701000000b8f56373885f4f77106262739862858b80d9f400d8996273f432627308336273a8b6197700000000b8b619776e2c8e4380d9f400 (UID: 00000000-00001156) "file.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000007c038000000000000000a114000014d9f400ee13677780000000ee13677700000000000000008000000090735f730000000034d9f40050724d7700007c03000000008000000090735f730200000070335f7350d9f4009b735f7301000000f0456073885f4f77000000009862858b80d9f40058755f7364335f73 (UID: 00000000-00001156) "kxetray.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000384)34:T623,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "file") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "file") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "file") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "file") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "file") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "file") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp")35:T95f,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "file") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "file") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "file") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "file") Found reference to API "function GetVersionComponents(const Filename: String; var Major, Minor, Revision, Build: Word): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")36:T1019,"file.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006116) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00006116) "file.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter %TEMP%\is-5Y4QX5UW08.tmp\_isetup\_isdecmp.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter SbieDll.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter avghookx.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter avghooka.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter snxhk.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter api_log.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter dir_watch.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter wpespy.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter cmdvrt32.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter cmdvrt64.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter SxIn.dll (UID: 00000000-00001156) "file.tmp" called "LoadLibrary" with a parameter cuckoomon.dll (UID: 00000000-00001156) "file.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002752) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00002752) "file.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter %TEMP%\is-OU3U12MCKU.tmp\_isetup\_isdecmp.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00008108) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00008108) "kxetray.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000384) "kxetray.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000384)37:T43c,"file.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\MidnightBlueCrimson\is-M4SLYOVDUR.tmp & %ALLUSERSPROFILE%\MidnightBlueCrimson\kis.dll (UID: 00000000-00008108) "file.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\MidnightBlueCrimson\is-HMYQQLTWO6.tmp & %ALLUSERSPROFILE%\MidnightBlueCrimson\kxetray.exe (UID: 00000000-00008108) "file.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\MidnightBlueCrimson\is-EIXQI7TQIT.tmp & %ALLUSERSPROFILE%\MidnightBlueCrimson\microsoft.vc80.crt.manifest (UID: 00000000-00008108) "file.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\MidnightBlueCrimson\is-MHUQIQX604.tmp & %ALLUSERSPROFILE%\MidnightBlueCrimson\msvcm80.dll (UID: 00000000-00008108) "file.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\MidnightBlueCrimson\is-0AQUCMFJQN.tmp & %ALLUSERSPROFILE%\MidnightBlueCrimson\msvcp80.dll (UID: 00000000-00008108) "file.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\MidnightBlueCrimson\is-PQ21FW6VHD.tmp & %ALLUSERSPROFILE%\MidnightBlueCrimson\msvcr80.dll (UID: 00000000-00008108)38:T9bb9,"file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006116) "file.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006116) "file.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressInit (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompress (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressEnd (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter RtlInitAnsiString (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter LdrGetProcedureAddress (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001156) "file.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00001156) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002752) "file.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002752) "file.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressInit (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompress (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressEnd (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter RtlInitAnsiString (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter LdrGetProcedureAddress (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SHGetStockIconInfo (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SHGetImageList (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00008108) "file.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00008108) "kxetray.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00000384) "kxetray.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00000384)39:T43a,Sleep@KERNEL32.DLL at 00000000-00002752-2335-108-01303EB8 Sleep@KERNEL32.DLL at 00000000-00002752-2335-109-01303C14 Sleep@KERNEL32.DLL at 00000000-00002752-2335-113-0130423C Sleep@KERNEL32.DLL at 00000000-00002752-2335-178-01306CC4 Sleep@KERNEL32.DLL at 00000000-00002752-2335-183-0130677C Sleep@KERNEL32.DLL at 00000000-00002752-2335-208-01304434 Sleep@KERNEL32.DLL at 00000000-00002752-2335-2635-01304A64 WaitForSingleObject@KERNEL32.DLL at 00000000-00002752-2335-2962-0133B86C Sleep@KERNEL32.DLL at 00000000-00002752-2335-2974-013988F4 WaitForSingleObject@KERNEL32.DLL at 00000000-00002752-2335-3479-01397BCC Sleep@KERNEL32.DLL at 00000000-00002752-2335-3709-013A94F8 MsgWaitForMultipleObjects at 00000000-00002752-2335-3727-013A9F84 MsgWaitForMultipleObjects at 00000000-00002752-2335-3732-0130FBA0 WaitForSingleObject@KERNEL32.DLL at 00000000-00002752-2335-3929-0132422A Sleep@KERNEL32.DLL at 00000000-00002752-2335-3935-01324358 WaitForSingleObject@KERNEL32.DLL at 00000000-00002752-2335-3936-01324220 Sleep@KERNEL32.DLL at 00000000-00002752-2335-5943-01323DFD3a:T1538a,Found reference to API (Indicator: "FreeSid"; File: "file") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "file") Found reference to API (Indicator: "OpenThreadToken"; File: "file") Found reference to API (Indicator: "RegQueryValueExW"; File: "file") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API (Indicator: "RegOpenKeyExW"; File: "file") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "file") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "file") Found reference to API (Indicator: "EqualSid"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "SetThreadLocale"; File: "file") Found reference to API (Indicator: "GetACP"; File: "file") Found reference to API (Indicator: "CreateDirectoryW"; File: "file") Found reference to API (Indicator: "HeapCreate"; File: "file") Found reference to API (Indicator: "TlsGetValue"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "LocalAlloc"; File: "file") Found reference to API (Indicator: "GetExitCodeThread"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetStdHandle"; File: "file") Found reference to API (Indicator: "GetFileAttributesW"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "LockResource"; File: "file") Found reference to API (Indicator: "DeleteFileW"; File: "file") Found reference to API (Indicator: "VirtualProtect"; File: "file") Found reference to API (Indicator: "GetCurrentThread"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "GetDriveTypeW"; File: "file") Found reference to API (Indicator: "VirtualFree"; File: "file") Found reference to API (Indicator: "CreateEventW"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "VirtualQueryEx"; File: "file") Found reference to API (Indicator: "EnumCalendarInfoW"; File: "file") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "file") Found reference to API (Indicator: "LoadLibraryExW"; File: "file") Found reference to API (Indicator: "GetVersion"; File: "file") Found reference to API (Indicator: "SwitchToThread"; File: "file") Found reference to API (Indicator: "SetLastError"; File: "file") Found reference to API (Indicator: "EnterCriticalSection"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "WideCharToMultiByte"; File: "file") Found reference to API (Indicator: "HeapAlloc"; File: "file") Found reference to API (Indicator: "FindFirstFileW"; File: "file") Found reference to API (Indicator: "MultiByteToWideChar"; File: "file") Found reference to API (Indicator: "GetVersionExW"; File: "file") Found reference to API (Indicator: "VirtualQuery"; File: "file") Found reference to API (Indicator: "GetThreadLocale"; File: "file") Found reference to API (Indicator: "GetModuleFileNameW"; File: "file") Found reference to API (Indicator: "VerSetConditionMask"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "file") Found reference to API (Indicator: "HeapDestroy"; File: "file") Found reference to API (Indicator: "GetVolumeInformationW"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "LoadLibraryW"; File: "file") Found reference to API (Indicator: "SetFilePointerEx"; File: "file") Found reference to API (Indicator: "SetThreadPriority"; File: "file") Found reference to API (Indicator: "GetFullPathNameW"; File: "file") Found reference to API (Indicator: "VirtualAlloc"; File: "file") Found reference to API (Indicator: "SetEndOfFile"; File: "file") Found reference to API (Indicator: "FormatMessageW"; File: "file") Found reference to API (Indicator: "CreateFileW"; File: "file") Found reference to API (Indicator: "SizeofResource"; File: "file") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API (Indicator: "SuspendThread"; File: "file") Found reference to API (Indicator: "FindResourceW"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GetTempPathW"; File: "file") Found reference to API (Indicator: "GetLocalTime"; File: "file") Found reference to API (Indicator: "GetLocaleInfoW"; File: "file") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "file") Found reference to API (Indicator: "HeapFree"; File: "file") Found reference to API (Indicator: "GetCPInfo"; File: "file") Found reference to API (Indicator: "CompareStringW"; File: "file") Found reference to API (Indicator: "RemoveDirectoryW"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "LeaveCriticalSection"; File: "file") Found reference to API (Indicator: "GetDateFormatW"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "RaiseException"; File: "file") Found reference to API (Indicator: "LoadResource"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "file") Found reference to API (Indicator: "RtlUnwind"; File: "file") Found reference to API (Indicator: "InitializeCriticalSection"; File: "file") Found reference to API (Indicator: "lstrlenW"; File: "file") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "file") Found reference to API (Indicator: "LCMapStringW"; File: "file") Found reference to API (Indicator: "ResumeThread"; File: "file") Found reference to API (Indicator: "GetCommandLineW"; File: "file") Found reference to API (Indicator: "TlsSetValue"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "GetCPInfoExW"; File: "file") Found reference to API (Indicator: "ExitThread"; File: "file") Found reference to API (Indicator: "GetFileSizeEx"; File: "file") Found reference to API (Indicator: "IsValidLocale"; File: "file") Found reference to API (Indicator: "CreateProcessW"; File: "file") Found reference to API (Indicator: "GetThreadPriority"; File: "file") Found reference to API (Indicator: "DeleteCriticalSection"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "CompareStringOrdinal"; File: "file") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "file") Found reference to API (Indicator: "GetProcessHeap"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; File: "file") Found reference to API (Indicator: "VariantChangeType"; File: "file") Found reference to API (Indicator: "VariantClear"; File: "file") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "file") Found reference to API (Indicator: "SafeArrayPutElement"; File: "file") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "file") Found reference to API (Indicator: "SysAllocStringLen"; File: "file") Found reference to API (Indicator: "VariantCopy"; File: "file") Found reference to API (Indicator: "SafeArrayGetElement"; File: "file") Found reference to API (Indicator: "SafeArrayAccessData"; File: "file") Found reference to API (Indicator: "VariantInit"; File: "file") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "file") Found reference to API (Indicator: "SysReAllocStringLen"; File: "file") Found reference to API (Indicator: "SysFreeString"; File: "file") Found reference to API (Indicator: "SafeArrayCreate"; File: "file") Found reference to API (Indicator: "PeekMessageW"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "LoadStringW"; File: "file") Found reference to API (Indicator: "CreateWindowExW"; File: "file") Found reference to API (Indicator: "DispatchMessageW"; File: "file") Found reference to API (Indicator: "TranslateMessage"; File: "file") Found reference to API (Indicator: "CharUpperW"; File: "file") Found reference to API (Indicator: "CharUpperBuffW"; File: "file") Found reference to API (Indicator: "CharLowerBuffW"; File: "file") Found reference to API (Indicator: "CharNextW"; File: "file") Found reference to API (Indicator: "DestroyWindow"; File: "file") Found reference to API (Indicator: "ExitWindowsEx"; File: "file") Found reference to API (Indicator: "MessageBoxW"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "file") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "file") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "file") Found reference to API (Indicator: "GetThreadUILanguage"; File: "file") Found reference to API (Indicator: "GetLongPathNameW"; File: "file") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "file") Found reference to API (Indicator: "InitializeConditionVariable"; File: "file") Found reference to API (Indicator: "WakeConditionVariable"; File: "file") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "file") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "file") Found reference to API (Indicator: "GetTickCount64"; File: "file") Found reference to API (Indicator: "CheckTokenMembership"; File: "file") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "file") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "file") Found reference to API (Indicator: "GetCurrentDirectory"; File: "file") Found reference to API (Indicator: "BCryptGenRandom"; File: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; File: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "file") Found reference to API (Indicator: "WTSRegisterSessionNotification"; File: "file") Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; File: "file") Found reference to API (Indicator: "RegLoadKeyW"; File: "file") Found reference to API (Indicator: "RegSetValueExW"; File: "file") Found reference to API (Indicator: "RegUnLoadKeyW"; File: "file") Found reference to API (Indicator: "RegDeleteValueW"; File: "file") Found reference to API (Indicator: "RegConnectRegistryW"; File: "file") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "file") Found reference to API (Indicator: "RegDeleteKeyW"; File: "file") Found reference to API (Indicator: "RegSaveKeyW"; File: "file") Found reference to API (Indicator: "GetUserNameW"; File: "file") Found reference to API (Indicator: "RegCreateKeyExW"; File: "file") Found reference to API (Indicator: "RegRestoreKeyW"; File: "file") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "file") Found reference to API (Indicator: "RegEnumValueW"; File: "file") Found reference to API (Indicator: "RegFlushKey"; File: "file") Found reference to API (Indicator: "RegReplaceKeyW"; File: "file") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "file") Found reference to API (Indicator: "RegEnumKeyExW"; File: "file") Found reference to API (Indicator: "GetOpenFileNameW"; File: "file") Found reference to API (Indicator: "GetSaveFileNameW"; File: "file") Found reference to API (Indicator: "BitBlt"; File: "file") Found reference to API (Indicator: "GetDIBits"; File: "file") Found reference to API (Indicator: "RoundRect"; File: "file") Found reference to API (Indicator: "GetObjectW"; File: "file") Found reference to API (Indicator: "DeleteDC"; File: "file") Found reference to API (Indicator: "GetStockObject"; File: "file") Found reference to API (Indicator: "StretchBlt"; File: "file") Found reference to API (Indicator: "SetDIBits"; File: "file") Found reference to API (Indicator: "GetDeviceCaps"; File: "file") Found reference to API (Indicator: "SetStretchBltMode"; File: "file") Found reference to API (Indicator: "DeleteObject"; File: "file") Found reference to API (Indicator: "CreateFontIndirectW"; File: "file") Found reference to API (Indicator: "CreateSolidBrush"; File: "file") Found reference to API (Indicator: "CreateCompatibleDC"; File: "file") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "file") Found reference to API (Indicator: "SelectObject"; File: "file") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "file") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API (Indicator: "IsDebuggerPresent"; File: "file") Found reference to API (Indicator: "FlushFileBuffers"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "SetHandleInformation"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "GetTempFileNameW"; File: "file") Found reference to API (Indicator: "GetShortPathNameW"; File: "file") Found reference to API (Indicator: "GetComputerNameW"; File: "file") Found reference to API (Indicator: "CreatePipe"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "ReleaseMutex"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "MulDiv"; File: "file") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "file") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "file") Found reference to API (Indicator: "GetOverlappedResult"; File: "file") Found reference to API (Indicator: "MoveFileExW"; File: "file") Found reference to API (Indicator: "DuplicateHandle"; File: "file") Found reference to API (Indicator: "CopyFileW"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "file") Found reference to API (Indicator: "GlobalAddAtomW"; File: "file") Found reference to API (Indicator: "OpenMutexW"; File: "file") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "file") Found reference to API (Indicator: "TerminateThread"; File: "file") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "file") Found reference to API (Indicator: "DeviceIoControl"; File: "file") Found reference to API (Indicator: "SetErrorMode"; File: "file") Found reference to API (Indicator: "GetProfileStringW"; File: "file") Found reference to API (Indicator: "FindNextFileW"; File: "file") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "lstrcmpW"; File: "file") Found reference to API (Indicator: "SetFileAttributesW"; File: "file") Found reference to API (Indicator: "CreateNamedPipeW"; File: "file") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "file") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "file") Found reference to API (Indicator: "PeekNamedPipe"; File: "file") Found reference to API (Indicator: "GetLogicalDrives"; File: "file") Found reference to API (Indicator: "CompareFileTime"; File: "file") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "file") Found reference to API (Indicator: "FreeResource"; File: "file") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateMutexW"; File: "file") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "file") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "file") Found reference to API (Indicator: "WriteProfileStringW"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "GlobalFindAtomW"; File: "file") Found reference to API (Indicator: "EnumResourceNamesW"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "file") Found reference to API (Indicator: "TransactNamedPipe"; File: "file") Found reference to API (Indicator: "MoveFileW"; File: "file") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "OpenProcess"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "WNetCloseEnum"; File: "file") Found reference to API (Indicator: "WNetGetConnectionW"; File: "file") Found reference to API (Indicator: "WNetOpenEnumW"; File: "file") Found reference to API (Indicator: "WNetGetUniversalNameW"; File: "file") Found reference to API (Indicator: "WNetEnumResourceW"; File: "file") Found reference to API (Indicator: "CoCreateInstance"; File: "file") Found reference to API (Indicator: "StringFromCLSID"; File: "file") Found reference to API (Indicator: "CoUninitialize"; File: "file") Found reference to API (Indicator: "OleUninitialize"; File: "file") Found reference to API (Indicator: "CoDisconnectObject"; File: "file") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "file") Found reference to API (Indicator: "CoInitializeEx"; File: "file") Found reference to API (Indicator: "IsEqualGUID"; File: "file") Found reference to API (Indicator: "CoInitialize"; File: "file") Found reference to API (Indicator: "OleInitialize"; File: "file") Found reference to API (Indicator: "CLSIDFromString"; File: "file") Found reference to API (Indicator: "CoTaskMemFree"; File: "file") Found reference to API (Indicator: "VariantCopyInd"; File: "file") Found reference to API (Indicator: "GetErrorInfo"; File: "file") Found reference to API (Indicator: "GetActiveObject"; File: "file") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "file") Found reference to API (Indicator: "ShellExecuteW"; File: "file") Found reference to API (Indicator: "ShellExecuteExW"; File: "file") Found reference to API (Indicator: "SHGetFileInfoW"; File: "file") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "file") Found reference to API (Indicator: "IsIconic"; File: "file") Found reference to API (Indicator: "GetSysColorBrush"; File: "file") Found reference to API (Indicator: "GetTopWindow"; File: "file") Found reference to API (Indicator: "CharLowerW"; File: "file") Found reference to API (Indicator: "KillTimer"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "DispatchMessageA"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "GetSubMenu"; File: "file") Found reference to API (Indicator: "MessageBeep"; File: "file") Found reference to API (Indicator: "EnumThreadWindows"; File: "file") Found reference to API (Indicator: "FrameRect"; File: "file") Found reference to API (Indicator: "GetIconInfo"; File: "file") Found reference to API (Indicator: "DrawFocusRect"; File: "file") Found reference to API (Indicator: "SetWindowRgn"; File: "file") Found reference to API (Indicator: "CreatePopupMenu"; File: "file") Found reference to API (Indicator: "GetSysColor"; File: "file") Found reference to API (Indicator: "GetScrollInfo"; File: "file") Found reference to API (Indicator: "EnumChildWindows"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "SetRect"; File: "file") Found reference to API (Indicator: "SystemParametersInfoW"; File: "file") Found reference to API (Indicator: "CharToOemBuffA"; File: "file") Found reference to API (Indicator: "DeleteMenu"; File: "file") Found reference to API (Indicator: "GetDCEx"; File: "file") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "file") Found reference to API (Indicator: "GetKeyNameTextW"; File: "file") Found reference to API (Indicator: "TrackPopupMenu"; File: "file") Found reference to API (Indicator: "GetMenuStringW"; File: "file") Found reference to API (Indicator: "GetMenuItemID"; File: "file") Found reference to API (Indicator: "ScrollWindow"; File: "file") Found reference to API (Indicator: "SetFocus"; File: "file") Found reference to API (Indicator: "GetWindowDC"; File: "file") Found reference to API (Indicator: "LoadCursorW"; File: "file") Found reference to API (Indicator: "ShowOwnedPopups"; File: "file") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "file") Found reference to API (Indicator: "OemToCharBuffA"; File: "file") Found reference to API (Indicator: "UnregisterClassW"; File: "file") Found reference to API (Indicator: "GetMenuState"; File: "file") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "file") Found reference to API (Indicator: "CloseClipboard"; File: "file") Found reference to API (Indicator: "OpenClipboard"; File: "file") Found reference to API (Indicator: "SetScrollInfo"; File: "file") Found reference to API (Indicator: "CopyImage"; File: "file") Found reference to API (Indicator: "GetParent"; File: "file") Found reference to API (Indicator: "SetWindowPlacement"; File: "file") Found reference to API (Indicator: "SetWindowPos"; File: "file") Found reference to API (Indicator: "DrawIconEx"; File: "file") Found reference to API (Indicator: "EnableWindow"; File: "file") Found reference to API (Indicator: "EnableMenuItem"; File: "file") Found reference to API (Indicator: "ScreenToClient"; File: "file") Found reference to API (Indicator: "FillRect"; File: "file") Found reference to API (Indicator: "GetForegroundWindow"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "DrawEdge"; File: "file") Found reference to API (Indicator: "GetClipboardData"; File: "file") Found reference to API (Indicator: "GetKeyboardLayout"; File: "file") Found reference to API (Indicator: "GetWindowTextW"; File: "file") Found reference to API (Indicator: "PeekMessageA"; File: "file") Found reference to API (Indicator: "GetClientRect"; File: "file") Found reference to API (Indicator: "GetKeyState"; File: "file") Found reference to API (Indicator: "GetScrollRange"; File: "file") Found reference to API (Indicator: "InsertMenuItemW"; File: "file") Found reference to API (Indicator: "InsertMenuW"; File: "file") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "file") Found reference to API (Indicator: "GetLastActivePopup"; File: "file") Found reference to API (Indicator: "UpdateWindow"; File: "file") Found reference to API (Indicator: "MapWindowPoints"; File: "file") Found reference to API (Indicator: "DefWindowProcW"; File: "file") Found reference to API (Indicator: "GetMenuItemCount"; File: "file") Found reference to API (Indicator: "WaitMessage"; File: "file") Found reference to API (Indicator: "GetCapture"; File: "file") Found reference to API (Indicator: "CreateIconIndirect"; File: "file") Found reference to API (Indicator: "PostQuitMessage"; File: "file") Found reference to API (Indicator: "GetKeyboardState"; File: "file") Found reference to API (Indicator: "ShowScrollBar"; File: "file") Found reference to API (Indicator: "DrawMenuBar"; File: "file") Found reference to API (Indicator: "IsWindowVisible"; File: "file") Found reference to API (Indicator: "RemoveMenu"; File: "file") Found reference to API (Indicator: "EnumWindows"; File: "file") Found reference to API (Indicator: "DestroyMenu"; File: "file") Found reference to API (Indicator: "GetWindowRect"; File: "file") Found reference to API (Indicator: "SetWindowTextW"; File: "file") Found reference to API (Indicator: "GetFocus"; File: "file") Found reference to API (Indicator: "IsZoomed"; File: "file") Found reference to API (Indicator: "InvalidateRect"; File: "file") Found reference to API (Indicator: "RegisterClassW"; File: "file") Found reference to API (Indicator: "TranslateMDISysAccel"; File: "file") Found reference to API (Indicator: "ShowCaret"; File: "file") Found reference to API (Indicator: "WindowFromPoint"; File: "file") Found reference to API (Indicator: "GetSystemMenu"; File: "file") Found reference to API (Indicator: "HideCaret"; File: "file") Found reference to API (Indicator: "MoveWindow"; File: "file") Found reference to API (Indicator: "CreateMenu"; File: "file") Found reference to API (Indicator: "GetCursor"; File: "file") Found reference to API (Indicator: "CheckMenuItem"; File: "file") Found reference to API (Indicator: "GetWindowPlacement"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "file") Found reference to API (Indicator: "SetMenu"; File: "file") Found reference to API (Indicator: "SetScrollRange"; File: "file") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "file") Found reference to API (Indicator: "SetCapture"; File: "file") Found reference to API (Indicator: "GetScrollPos"; File: "file") Found reference to API (Indicator: "GetCursorPos"; File: "file") Found reference to API (Indicator: "IsWindow"; File: "file") Found reference to API (Indicator: "SetTimer"; File: "file") Found reference to API (Indicator: "ClientToScreen"; File: "file") Found reference to API (Indicator: "IsChild"; File: "file") Found reference to API (Indicator: "LoadIconW"; File: "file") Found reference to API (Indicator: "OffsetRect"; File: "file") Found reference to API (Indicator: "DestroyCursor"; File: "file") Found reference to API (Indicator: "SetActiveWindow"; File: "file") Found reference to API (Indicator: "CallNextHookEx"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "ReleaseCapture"; File: "file") Found reference to API (Indicator: "DrawIcon"; File: "file") Found reference to API (Indicator: "LoadImageW"; File: "file") Found reference to API (Indicator: "EnableScrollBar"; File: "file") Found reference to API (Indicator: "SetScrollPos"; File: "file") Found reference to API (Indicator: "IsWindowEnabled"; File: "file") Found reference to API (Indicator: "GetActiveWindow"; File: "file") Found reference to API (Indicator: "SendMessageA"; File: "file") Found reference to API (Indicator: "SetCursor"; File: "file") Found reference to API (Indicator: "GetMenu"; File: "file") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "file") Found reference to API (Indicator: "InflateRect"; File: "file") Found reference to API (Indicator: "SetParent"; File: "file") Found reference to API (Indicator: "AppendMenuW"; File: "file") Found reference to API (Indicator: "DestroyIcon"; File: "file") Found reference to API (Indicator: "CopyIcon"; File: "file") Found reference to API (Indicator: "BeginPaint"; File: "file") Found reference to API (Indicator: "SetClipboardData"; File: "file") Found reference to API (Indicator: "DrawFrameControl"; File: "file") Found reference to API (Indicator: "GetWindow"; File: "file") Found reference to API (Indicator: "RedrawWindow"; File: "file") Found reference to API (Indicator: "CreateIcon"; File: "file") Found reference to API (Indicator: "IsDialogMessageA"; File: "file") Found reference to API (Indicator: "SetCursorPos"; File: "file") Found reference to API (Indicator: "EmptyClipboard"; File: "file") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "file") Found reference to API (Indicator: "VerQueryValueW"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "file") Found reference to API (Indicator: "WinHttpQueryAuthSchemes"; File: "file") Found reference to API (Indicator: "WinHttpSendRequest"; File: "file") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; File: "file") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "file") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; File: "file") Found reference to API (Indicator: "WinHttpSetStatusCallback"; File: "file") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; File: "file") Found reference to API (Indicator: "WinHttpQueryOption"; File: "file") Found reference to API (Indicator: "WinHttpConnect"; File: "file") Found reference to API (Indicator: "WinHttpSetOption"; File: "file") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "file") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "file") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "file") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "file") Found reference to API (Indicator: "WinHttpOpen"; File: "file") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "file") Found reference to API (Indicator: "WinHttpSetCredentials"; File: "file") Found reference to API (Indicator: "WinHttpReadData"; File: "file") Found reference to API (Indicator: "WinHttpWriteData"; File: "file") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "file") Found reference to API (Indicator: "OpenSCManagerW"; File: "file") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "file") Found reference to API (Indicator: "SetTokenInformation"; File: "file") Found reference to API (Indicator: "ControlService"; File: "file") Found reference to API (Indicator: "CloseServiceHandle"; File: "file") Found reference to API (Indicator: "GetLengthSid"; File: "file") Found reference to API (Indicator: "DuplicateTokenEx"; File: "file") Found reference to API (Indicator: "QueryServiceStatus"; File: "file") Found reference to API (Indicator: "StartServiceW"; File: "file") Found reference to API (Indicator: "OpenServiceW"; File: "file") Found reference to API (Indicator: "Process32NextW"; File: "file") Found reference to API (Indicator: "GetLocaleInfoA"; File: "file") Found reference to API (Indicator: "HeapReAlloc"; File: "file") Found reference to API (Indicator: "InterlockedDecrement"; File: "file") Found reference to API (Indicator: "HeapSize"; File: "file") Found reference to API (Indicator: "WaitNamedPipeW"; File: "file") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "file") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "file") Found reference to API (Indicator: "lstrcmpiW"; File: "file") Found reference to API (Indicator: "SetProcessWorkingSetSize"; File: "file") Found reference to API (Indicator: "IsBadReadPtr"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "CreateTimerQueue"; File: "file") Found reference to API (Indicator: "GetVersionExA"; File: "file") Found reference to API (Indicator: "InterlockedExchange"; File: "file") Found reference to API (Indicator: "OutputDebugStringA"; File: "file") Found reference to API (Indicator: "FindResourceExW"; File: "file") Found reference to API (Indicator: "InterlockedIncrement"; File: "file") Found reference to API (Indicator: "CreateTimerQueueTimer"; File: "file") Found reference to API (Indicator: "DeleteTimerQueueEx"; File: "file") Found reference to API (Indicator: "Process32FirstW"; File: "file") Found reference to API (Indicator: "DeleteTimerQueueTimer"; File: "file") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "file") Found reference to API (Indicator: "UuidFromStringW"; File: "file") Found reference to API (Indicator: "CommandLineToArgvW"; File: "file") Found reference to API (Indicator: "PathRemoveFileSpecW"; File: "file") Found reference to API (Indicator: "PathFileExistsW"; File: "file") Found reference to API (Indicator: "wsprintfW"; File: "file") Found reference to API (Indicator: "SetMenuInfo"; File: "file") Found reference to API (Indicator: "UnregisterClassA"; File: "file") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "file") Found reference to API (Indicator: "GetMenuInfo"; File: "file") Found reference to API (Indicator: "WSACleanup"; File: "file") Found reference to API (Indicator: "CoTaskMemRealloc"; File: "file") Found reference to API (Indicator: "SetEntriesInAclW"; File: "file") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "file") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "file") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "file") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "file") Found reference to API (Indicator: "StrToInt64ExW"; File: "file") Found reference to API (Indicator: "WNetEnumResourceW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "WNetGetUniversalNameW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "WNetCloseEnum"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "WNetOpenEnumW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "OemToCharBuffA"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "ShowCaret"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "CharToOemBuffA"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformationForYear"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CryptDecodeObject"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "PFXImportCertStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertNameToStrW"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertFindChainInStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00001156.00000000.171027.00DAA000.00000004.mdmp, 00000000-00001156.00000002.173488.00DAA000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API (Indicator: "RtlInitAnsiString"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API (Indicator: "PathCombine"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00001156.00000001.172949.03230000.00000004.mdmp, 00000000-00001156.00000002.173488.03230000.00000004.mdmp") Found reference to API (Indicator: "StrToInt64ExW"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00001156.00000002.173488.00DAD000.00000002.mdmp") Found reference to API (Indicator: "RtlCompareUnicodeString"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp, 00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp, 00000000-00002752.00000000.173792.05130000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp, 00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp, 00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp, 00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp, 00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp, 00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000000.173792.05130000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "RegisterClass"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClass"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000000.173792.05130000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "EnumCalendarInfoW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SetThreadLocale"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayPutElement"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VariantInit"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VariantClear"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayAccessData"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SysReAllocStringLen"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayCreate"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayGetElement"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayUnaccessData"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VariantCopy"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayGetUBound"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayGetLBound"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "VariantChangeType"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")3b:T4f5,Found reference to API "LockResource" (Indicator: "LockResource"; File: "file") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "file") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "file") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "file") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "file") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "file") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")3c:T44c,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "file") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "file") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "file") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")3d:T1068,"Software\Embarcadero\Locales" in Source: file "Software\CodeGear\Locales" in Source: file "Software\Borland\Locales" in Source: file "Software\Borland\Delphi\Locales" in Source: file "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: file "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001156.00000000.171027.03230000.00000004.mdmp 00000000-00001156.00000001.172949.03230000.00000004.mdmp 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00001156.00000000.171027.03230000.00000004.mdmp 00000000-00001156.00000001.172949.03230000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00001156.00000001.172949.06410000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}" in Source: 00000000-00001156.00000001.172949.06410000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001156.00000002.173488.03230000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00001156.00000002.173488.03230000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\file.exe" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft" in Source: 00000000-00002752.00000000.173792.010B0000.00000004.mdmp 00000000-00002752.00000001.173873.010B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002752.00000000.173792.010B0000.00000004.mdmp 00000000-00002752.00000001.173873.010B0000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp3e:T92c,Process file.tmp created mutex with name "\BaseNamedObjects\SyncRootManager" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1156:64:WilError_01" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1156:168:WilStaging_02" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process file.tmp created mutex with name "Local\SM0:1156:168:WilStaging_02" Process file.tmp created mutex with name "Local\SM0:1156:64:WilError_01" Process file.tmp created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process file.tmp created mutex with name "Local\ZonesLockedCacheCounterMutex" Process file.tmp created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process file.tmp created mutex with name "SM0:1156:168:WilStaging_02" Process file.tmp created mutex with name "SM0:1156:64:WilError_01" Process file.tmp created mutex with name "Local\ZonesCacheCounterMutex" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1156:168:WilStaging_02" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1156:64:WilError_01" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8108:168:WilStaging_02" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8108:168:WilStaging_02" Process file.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8108:64:WilError_01" Process file.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process file.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process file.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer"3f:T1323,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001156.00000000.171027.03230000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00001156.00000000.171027.03230000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001156.00000001.172949.03230000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00001156.00000001.172949.03230000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00001156.00000001.172949.06410000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}" in Source: 00000000-00001156.00000001.172949.06410000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001156.00000002.173488.03230000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00001156.00000002.173488.03230000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001156.00000002.173488.06410000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\file.exe" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001156.00000002.173488.06647000.00000004.mdmp "Software\Policies\Microsoft" in Source: 00000000-00002752.00000000.173792.010B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002752.00000000.173792.010B0000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002752.00000000.173792.01301000.00000020.mdmp "Software\Policies\Microsoft" in Source: 00000000-00002752.00000001.173873.010B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002752.00000001.173873.010B0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00008108.00000000.173865.0115C000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00008108.00000000.173865.033B4000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00008108.00000000.173865.033B4000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00008108.00000000.173865.033B4000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00008108.00000000.173865.033B4000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00008108.00000000.173865.033B4000.00000004.mdmp40:T11d0,"file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73eb0000 "file.exe" loaded module "KERNEL32.DLL" at base 758a0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 73e90000 "file.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76990000 "file.exe" loaded module "RPCRT4.DLL" at base 742e0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e10000 "file.exe" loaded module "NTDLL.DLL" at base 77630000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d40000 "file.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73eb0000 "file.tmp" loaded module "KERNEL32.DLL" at base 758a0000 "file.tmp" loaded module "MSCTF.DLL" at base 75c30000 "file.tmp" loaded module "IMM32.DLL" at base 75c00000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e10000 "file.tmp" loaded module "NTDLL.DLL" at base 77630000 "file.tmp" loaded module "RPCRT4.DLL" at base 742e0000 "file.tmp" loaded module "UXTHEME.DLL" at base 73e10000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74560000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 73e90000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76990000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73930000 "file.tmp" loaded module "%TEMP%\IS-5Y4QX5UW08.TMP\_ISETUP\_ISDECMP.DLL" at base 5160000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 73900000 "file.tmp" loaded module "SHELL32.DLL" at base 74560000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 73890000 "file.tmp" loaded module "WINHTTP.DLL" at base 73990000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73870000 "file.tmp" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77090000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 73850000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 775b0000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 737d0000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73720000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73710000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73650000 "file.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77090000 "file.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77090000 "file.tmp" loaded module "%WINDIR%\SYSWOW64\SCRRUN.DLL" at base 73620000 "file.tmp" loaded module "%WINDIR%\SYSWOW64\WSHOM.OCX" at base 735f0000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 733e0000 "file.tmp" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 758a0000 "file.tmp" loaded module "USER32.DLL" at base 76c00000 "file.tmp" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72f60000 "file.tmp" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74560000 "file.tmp" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73210000 "file.tmp" loaded module "MSISO.DLL" at base 72f00000 "file.tmp" loaded module "SSPICLI.DLL" at base 74050000 "file.tmp" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77090000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75db0000 "file.tmp" loaded module "%TEMP%\IS-OU3U12MCKU.TMP\_ISETUP\_ISDECMP.DLL" at base 5140000 "file.tmp" loaded module "COMCTL32" at base 73a90000 "file.tmp" loaded module "COMCTL32.DLL" at base 73a90000 "file.tmp" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 736f0000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 73740000 "file.tmp" loaded module "DWMAPI.DLL" at base 73de0000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 6010000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 73120000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d40000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73de0000 "kxetray.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73eb0000 "kxetray.exe" loaded module "WINHTTP.DLL" at base 73990000 "kxetray.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73720000 "kxetray.exe" loaded module "RPCRT4.DLL" at base 742e0000 "kxetray.exe" loaded module "BCRYPT.DLL" at base 73e90000 "kxetray.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7699000041:T57d,"file" was detected as "Inno Setup Module" and name: "Installer" "file" was detected as ".NET Reactor" and name: "Protector" "file" was detected as "Embarcadero Delphi" and name: "Compiler" "file" was detected as "Turbo Linker" and name: "Linker" "_isdecmp.dll" was detected as "Inno Setup Module" and name: "Installer" "_isdecmp.dll" was detected as ".NET Reactor" and name: "Protector" "_isdecmp.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "_isdecmp.dll" was detected as "Turbo Linker" and name: "Linker" "file.tmp" was detected as "Inno Setup Module" and name: "Installer" "file.tmp" was detected as ".NET Reactor" and name: "Protector" "file.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "file.tmp" was detected as "Turbo Linker" and name: "Linker" "is-HMYQQLTWO6.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-HMYQQLTWO6.tmp" was detected as ".NET Reactor" and name: "Protector" "is-HMYQQLTWO6.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-HMYQQLTWO6.tmp" was detected as "Turbo Linker" and name: "Linker" "_setup64.tmp" was detected as "Inno Setup Module" and name: "Installer" "_setup64.tmp" was detected as ".NET Reactor" and name: "Protector" "_setup64.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "_setup64.tmp" was detected as "Turbo Linker" and name: "Linker"42:Tbb0,"file.tmp" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\WOW6432NODE\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "file.tmp" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS") "file.tmp" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "file.tmp" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "file.tmp" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "file.tmp" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "file.tmp" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "file.tmp" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "file.tmp" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "file.tmp" touched "FileSystem Object" (Path: "HKCU\WOW6432NODE\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "file.tmp" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "file.tmp" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "file.tmp" touched "Windows Script Host Shell Object" (Path: "HKCU\WOW6432NODE\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "file.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "file.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "file.tmp" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "file.tmp" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "file.tmp" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "file.tmp" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "file.tmp" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "file.tmp" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}") "file.tmp" touched "Shared Bitmap Object" (Path: "HKCU\WOW6432NODE\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\TREATAS") "file.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS")43:T5ae,Spawned process "file.tmp" with commandline "/SL5="$300E4 5458033 1012736 C:\\file.exe"" (UID: 00000000-00001156) Spawned process "file.exe" with commandline "/VERYSILENT /PASSWORD=b0c6c99a-2665-4bb3-b505-0821a4e4a231" (UID: 00000000-00002752) Spawned process "file.tmp" with commandline "/SL5="$400E4 5458033 1012736 C:\\file.exe" /VERYSILENT /PASSWORD ..." (UID: 00000000-00008108) Spawned process "kxetray.exe" with commandline "--webview-exe-name=SearchHost.exe" (UID: 00000000-00000384) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002920) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006336), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00001328), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004952), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008168), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00005092), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004956)44:T5ae,Spawned process "file.tmp" with commandline "/SL5="$300E4 5458033 1012736 C:\\file.exe"" (UID: 00000000-00001156) Spawned process "file.exe" with commandline "/VERYSILENT /PASSWORD=b0c6c99a-2665-4bb3-b505-0821a4e4a231" (UID: 00000000-00002752) Spawned process "file.tmp" with commandline "/SL5="$400E4 5458033 1012736 C:\\file.exe" /VERYSILENT /PASSWORD ..." (UID: 00000000-00008108) Spawned process "kxetray.exe" with commandline "--webview-exe-name=SearchHost.exe" (UID: 00000000-00000384) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002920) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006336), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00001328), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004952), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008168), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00005092), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004956)45:T512,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001156.00000000.171027.05430000.00000004.mdmp, 00000000-00001156.00000001.172949.05430000.00000004.mdmp") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002752.00000000.173792.013B3000.00000004.mdmp, 00000000-00002752.00000000.173792.05130000.00000004.mdmp, 00000000-00002752.00000001.173873.013B3000.00000004.mdmp")46:T6c9,"_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-5Y4QX5UW08.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00008108] "is-M4SLYOVDUR.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) UPX compressed 3 sections"- Location: [%ALLUSERSPROFILE%\MidnightBlueCrimson\is-M4SLYOVDUR.tmp]- [targetUID: 00000000-00008108] "file.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-VPJ2ZMF89S.tmp\file.tmp]- [targetUID: 00000000-00006116] "is-HMYQQLTWO6.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%ALLUSERSPROFILE%\MidnightBlueCrimson\is-HMYQQLTWO6.tmp]- [targetUID: 00000000-00008108] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-OU3U12MCKU.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00008108] "is-EIXQI7TQIT.tmp" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with very long lines (504) with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\MidnightBlueCrimson\is-EIXQI7TQIT.tmp]- [targetUID: 00000000-00008108] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-OU3U12MCKU.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00008108] "file.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-MBIAOL2RQ0.tmp\file.tmp]- [targetUID: 00000000-00006116] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-5Y4QX5UW08.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00008108]47:T484,"is-M4SLYOVDUR.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) UPX compressed 3 sections" - Location: [%ALLUSERSPROFILE%\MidnightBlueCrimson\is-M4SLYOVDUR.tmp] "file.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\is-VPJ2ZMF89S.tmp\file.tmp] "is-HMYQQLTWO6.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" - Location: [%ALLUSERSPROFILE%\MidnightBlueCrimson\is-HMYQQLTWO6.tmp] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections" - Location: [%TEMP%\is-OU3U12MCKU.tmp\_isetup\_setup64.tmp] "is-EIXQI7TQIT.tmp" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with very long lines (504) with CRLF line terminators" - Location: [%ALLUSERSPROFILE%\MidnightBlueCrimson\is-EIXQI7TQIT.tmp] "file.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\is-MBIAOL2RQ0.tmp\file.tmp] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections" - Location: [%TEMP%\is-5Y4QX5UW08.tmp\_isetup\_setup64.tmp]48:T4e7,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")49:Ta79,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILE.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")4a:T54c,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size4b:T764,"file.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\MSVCP140.DLL" "file.exe" trying to access non-existent file "C:\MSVCP140.dll" "file.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "file.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "file.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "file.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "file.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\IPHLPAPI.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\BCRYPT.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\bcrypt.dll" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\WTSAPI32.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\FLTLIB.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\MSVCP140.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\MSVCP140.dll" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\VCRUNTIME140.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\VCRUNTIME140.dll" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\CRYPTSP.DLL"4c:T870,"file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-MBIAOL2RQ0.TMP" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\WINSPOOL.DRV" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\winspool.drv" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\FILE.TMP.LOCAL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBIAOL2RQ0.tmp\file.tmp.Local\" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-5Y4QX5UW08.TMP" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-5Y4QX5UW08.tmp" "file.tmp" trying to access non-existent file "C:\Users\ADMIN" "file.tmp" trying to access non-existent file "C:\Users\admin" "file.tmp" trying to access non-existent file "C:\ProgramData\MIDNIGHTBLUECRIMSON" "file.tmp" trying to access non-existent file "C:\ProgramData\MidnightBlueCrimson" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-VPJ2ZMF89S.TMP" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VPJ2ZMF89S.tmp" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VPJ2ZMF89S.tmp\FILE.TMP.LOCAL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VPJ2ZMF89S.tmp\file.tmp.Local\" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VPJ2ZMF89S.tmp\WINSPOOL.DRV" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-VPJ2ZMF89S.tmp\winspool.drv" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-OU3U12MCKU.TMP" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-OU3U12MCKU.tmp" "file.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG"4d:T5a8,Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "file") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "file") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "file") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "file") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "file") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00001156.00000000.171027.00DA3000.00000004.mdmp, 00000000-00001156.00000002.173488.00DA3000.00000004.mdmp")4e:T783,Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "file") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "file") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "file") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "file") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "file") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "file") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "file") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "file") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "file") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "file") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "file") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "file") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "file") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "file") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "file") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "file") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "file") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "file") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "file") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "file")4f:T53e,Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://crl.certum.pl/ctnca.crl0k_0]0" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Heuristic match: "nxseobso3uza7jtovszrhkveqdwk8eibsserlvgalnphcem.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "cim_system.name" Heuristic match: "im_system.name" Heuristic match: "m.name" Heuristic match: "font.name" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "em32\drivers\windowstrustedrt.sy" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"50:Tf3d,Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00002752.00000000.173792.01301000.00000020.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00008108.00000000.173865.033B4000.00000004.mdmp") Found URL "https://npcap.com/