26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 84:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 1e003273a6cf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1e003273a6cf…. Malware family: Malware. Threat score 100/100. 6/28 AV engines flagged this file. 17 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1e003273a6cf7c60048cbc8ebd7dc4e9dd14ad52b444be80bf6a06781c87eeee","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","1e003273a6cf7c60048cbc8ebd7dc4e9dd14ad52b444be80bf6a06781c87eeee"],"about":{"@type":"SoftwareApplication","name":"f7bce3836c364ecd1baa6686179edcea.exe","applicationCategory":["peexe","executable"],"identifier":"1e003273a6cf7c60048cbc8ebd7dc4e9dd14ad52b444be80bf6a06781c87eeee","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":17,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T47b,"f7bce3836c364ecd1baa6686179edcea.exe" called "FindResourceA" with parameter "15995724" - (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "FindResourceA" with parameter "2095832" - (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "FindResourceA" with parameter "15995592" - (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "FindResourceA" with parameter "15995600" - (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "FindResourceA" with parameter "15995628" - (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "FindResourceA" with parameter "15995656" - (UID: 00000000-00002844) "Vx2jd75.exe" called "FindResourceA" with parameter "19010380" - (UID: 00000000-00003584) "Vx2jd75.exe" called "FindResourceA" with parameter "2161268" - (UID: 00000000-00003584) "Vx2jd75.exe" called "FindResourceA" with parameter "19010248" - (UID: 00000000-00003584) "Vx2jd75.exe" called "FindResourceA" with parameter "19010256" - (UID: 00000000-00003584) "Vx2jd75.exe" called "FindResourceA" with parameter "19010284" - (UID: 00000000-00003584)28:Ta98,"f7bce3836c364ecd1baa6686179edcea.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16041952'}" (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042064'}" (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042096'}" (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042080'}" (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadResource with parameter " (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042000'}" (UID: 00000000-00002844) "Vx2jd75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19056608'}" (UID: 00000000-00003584) "Vx2jd75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19056720'}" (UID: 00000000-00003584) "Vx2jd75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19056752'}" (UID: 00000000-00003584) "Vx2jd75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19056736'}" (UID: 00000000-00003584) "Vx2jd75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19056704'}" (UID: 00000000-00003584) "Vx2jd75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19056656'}" (UID: 00000000-00003584) "Qy9FJ79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16894032'}" (UID: 00000000-00003380) "Qy9FJ79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16894064'}" (UID: 00000000-00003380) "Qy9FJ79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16894048'}" (UID: 00000000-00003380) "Qy9FJ79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16894016'}" (UID: 00000000-00003380) "EC8cv45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520080'}" (UID: 00000000-00002960) "EC8cv45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520112'}" (UID: 00000000-00002960) "EC8cv45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520064'}" (UID: 00000000-00002960) "EC8cv45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520016'}" (UID: 00000000-00002960) "EC8cv45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520096'}" (UID: 00000000-00002960) "1pt61fh6.exe" called "LoadResource with parameter {'hModule': '13500416', 'hResInfo': '14370088'}" (UID: 00000000-00003864)29:T4fe,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")2a:T522,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")2b:Tb6c,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")2c:T64d,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") file/memory contains long string with (Indicator: "Aes"; File: "SSL") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp")2d:Td30,"AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d97c73a86380768ce089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "vx6LFsVGnx7VXbsVZ9jsu5yYiJV2H4y2BZM4TH3X7qDEE4E25Wa/PKN/gTVT9OGxvLiotVRs6ZQ/s0w+CLLCrbU+qzblZP5692ebcwa0n96wlYK1Vj+slGDrGnZdjOOqnz6rNuVm5BPffZs1R/jMm7y67ftUJayUYPlaLRG1j8vQbud1rSr4drA+33QLtYne+fni+x9y5NsnvzVGXffOgJ8+qzbnI+U8732ZWAKsjfb96+O3exWsliWzGGwA++Oqnz6r" "cchString": "16956" "dwFlags": "1" "pcbBinary": "ab310000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "vx6LFsVGnx7VXbsVZ9jsu5yYiJV2H4y2BZM4TH3X7qDEE4E25Wa/PKN/gTVT9OGxvLiotVRs6ZQ/s0w+CLLCrbU+qzblZP5692ebcwa0n96wlYK1Vj+slGDrGnZdjOOqnz6rNuVm5BPffZs1R/jMm7y67ftUJayUYPlaLRG1j8vQbud1rSr4drA+33QLtYne+fni+x9y5NsnvzVGXffOgJ8+qzbnI+U8732ZWAKsjfb96+O3exWsliWzGGwA++Oqnz6r" "cchString": "16956" "dwFlags": "1" "pbBinary": "bf1e8b16c5469f1ed55dbb1567d8ecbb9c988895761f8cb60593384c7dd7eea0c4138136e566bf3ca37f813553f4e1b1bcb8a8b5546ce9943fb34c3e08b2c2adb53eab36e564fe7af7679b7306b49fdeb09582b5563fac9460eb1a765d8ce3aa9f3eab36e566e413df7d9b3547f8cc9bbcbaedfb5425ac9460f95a2d11b58fcbd06ee775ad2af876b03edf740bb589def9f9e2fb1f72e4db27bf35465df7ce809f3eab36e723e53cef7d995802ac8df6fdebe3b77b15ac9625b3186c00fbe3aa9f3eab36e566e413df7d9b3547f8cc9bbcbaedfb5425ac946bf85a2515b18cc5d079ea73a429fa76b938dd7b0cb788d9f9feefe51174e2d827bf35465df7ce809f3eab36e723e53cef7d995802ac8df6fdebe3b77b15ac9625b3186c00fbe3aa9f3eab36e566e413df7d9b3547f8cc9bbcbaedfb5425ac9460f4522519bd8cd0d872e275ad22fc71bb39d97605bc82d9f9fdf8e5117bfcde27bf35465df7ce809f3eab36e723e53cef7d994115ad9fcfbccfe9f91a7af8940899186c5df7ce80c232861ce566bf3ef57dc0186df8cc9bbcb8a8b5563de9d827a9186e14b580c5d57aed7ca82bf46eb633d76502ba87d7f1f6e3fa1370e5de6af55d2f5ffbe3aa9f3eab36e566bf3ef738c1375df8ceefeef7e6d91f71e7940899186c5df7ce80c232861ce566bf3ef57dc0186df8cc9bbcb8a8b5563de9d827a9186e1bb984c8d275e37ea82dfd74be36da7709bc8fd5f2f7eff41170ebd46bf65d2f5ffbe3aa9f3eab36e566bf3ef738c1375df8cee9f3f6e1fb5648edda69f64c6e70ddce809f3eab36b86a9214f57d9b3547f897b696b8a8b5563fac9625b15d225fedce82d976e979ad2ff27fb031d97a0fa886d9fef4ecf61878efd864e3562812b384d09d32861ce566bf3ef57d9b3545bd9699a6b8aad71f71edd866f6180f15b687ce9f49ea7aa923eb3cd8579b3547f8cc9be1b4859f563fac9625b3434177f7ce809f3eab36e564fa70f7679b3701be82d9f9f4eef1197ae5d96df6562717be8cced27fef7cac23f774bd3cd17745f4e1b1bcb8a8b5563fac9627f6426e47f7ccf9d06ce47fe74b953ef57d9b3547a5c0b696b8a8b5563faccd0899186c5df7ce809f3ea973ab64a53ef737d97106b78fd5f9f1e1fc1872e6d46fff5f2d11bf8dc5d379e973af2bf177b17f97186df8cc9bbcb8a8b5563de9cc27a9186e33be88d4c63c861ce566bf3ef57dc6396ad2cc9bbcb8a8b50d12869625b3186c5df7ce82da70a92ce564fe78b73ed97f17ba9cddfdfce4fe1b77e1d569fb532918b88acdde73e870a925bd32d8579b3547f8cc9bbcb8aaf00c3db69627de593815f5e3aa9f3eab36e566e232d8579b3547f8cc9be79582b5563fac9625b3186e18b9cc9a9f3ce378a327f175bb32d87302b78ad9f8fceff61f75e2db6dfd5e2216b380c1" "pcbBinary": "ab310000"}2e:T14be,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003380-40157-31-01012390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003380-40157-31-01012390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-43-01011AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-43-01011AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-44-01012AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-44-01012AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-41-01016495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-41-01016495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-26-010124E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-26-010124E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-40-01012267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-40-01012267 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003380-40157-36-01013BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003380-40157-36-01013BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-22-0101681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-22-0101681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-42-0101202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00003380-40157-42-0101202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-42-0101202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-33-01012F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-33-01012F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-29-010152B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-29-010152B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-37-01013FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-37-01013FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-16-010144B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-16-010144B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003380-40157-15-01011F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003380-40157-15-01011F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-463-0026B5EC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-463-0026B5EC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-321-00268E12 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-321-00268E12 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-332-00269491 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-332-00269491 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-335-00269095 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-335-00269095 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002228-55241-150-00261160 Assembly shows XOR instruction xor eax 0000014Dh in Stream UID: 00000000-00002228-55241-150-00261160 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002228-55241-150-00261160 Assembly shows XOR instruction xor esi ecx in Stream UID: 00000000-00002228-55241-150-00261160 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00002228-55241-150-00261160 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002228-55241-150-00261160 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-465-0026B6C7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-465-0026B6C7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-286-0026883C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-286-0026883C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-416-0026CE68 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-416-0026CE68 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-451-0026B134 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-451-0026B134 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-347-0026A229 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-347-0026A229 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002228-55241-466-0026B7B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002228-55241-466-0026B7B02f:T6c1a,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "43Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=IyPazILkyMGjcFpMSO3qContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:44:18 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:44:18 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:44:18 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:44:18 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:44:18 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"30:T4f4,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: PCAP contains base64 strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to decode base64 data Matched sigs: Decrypted SSL network traffic Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)31:T2a0b,"f7bce3836c364ecd1baa6686179edcea.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002844) "Vx2jd75.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003584) "Qy9FJ79.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003380) "EC8cv45.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002960) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000059006cf65900a800170040f8590095e1a977a8001700feffffffff2bad779a2aad77880adb000000000000000000c4006f0001000000000000000a00000008000000188f7400188f74002000000054f759007f21d100888e7400148e7400020000000d000000000000004cf75900bb2fd100f80ddb0088f759008e1ed100020000007e1ed100d681ebaf02000000a0c8d7000d000000000000005cf75900086dad7740f85900202dd00096fc68affeffffff7e1ed1002d1fd1009cf75900b8f75900a0f759000200000002000000b8f75900c0f759002022d10002000000b8f75900 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000276da0dddd0266ffcc0499ffff04ccffff0490dddd020000276d0000000001000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000276dc0e13e0466ffcc0499ffff04ccffff04b0e13e040000276d0000000001000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000276d10e2c80266ffcc0499ffff04ccffff0400e2c8020000276d0000000001000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e942239ad48e4dd022a9dea76000000002483ff76040000000000000000000000c4f5dd0200000000e79cea76020007805cdedd020000000076000000acdedd02feffffff34dedd02cf00ae77d600ae778cc26775760000003b000000acdedd026f006e0008dedd026e00740070dedd02 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000276dc0de350466ffcc0499ffff04ccffff04b0de35040000276d0000000001000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000276d30e5300466ffcc0499ffff04ccffff0420e530040000276d0000000001000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000276dd0e4dd0266ffcc0499ffff04ccffff04c0e4dd020000276d0000000001000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000276d90df790466ffcc0499ffff04ccffff0480df79040000276d0000000001000000 (UID: 00000000-00003864) "1pt61fh6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000276df0e2330466ffcc0499ffff04ccffff04e0e233040000276d0000000001000000 (UID: 00000000-00003864)32:T178d,"1pt61fh6.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003864) "AppLaunch.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003652) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003652) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100003ce82f008a878475f8715800ece82f00980a0b02980a0b02000000002c308475b2f4ad77d20b8a77d4e82f0000006d6900006d693ce82f0064e82f00f0000000f0006d690000000040e82f0000000000d4e92f000000000001000000a4e82f0040f5ad77000000000000000090e82f00 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031001848f4e807b29cc0763437ca5f000000000100000000000000010000006cf4e8070000000028120c02a8f4e8071055e70678f4e8078f9cc0763437ca5f020000000000000018000000010000007cf4e8072823b26600005400000000000c0000002042220288f4e8072f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076a014e806f0e9e50600000000a014e8061000000000000000b0e82f0050dc6877a014e806100000006c3ee406540ad50710000000dce82f00a6ec6c6f02000000000000001800000028c76c6fe0e82f002823b26600005400000000000c00000028c76c6fece82f002f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000d8e92f006a6fc66600000000bc6fc6669968b31f54e52f0000000000c0ee2f0015de04775d449a68feffffff7f670c77e2d8cf7628242b6f02000000000000001800000030a5ca5f98e92f002823b26600005400000000000c00000030a5ca5fa4e92f002f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076a014e806f0e9e50600000000a014e80610000000000000009ce72f0050dc6877a014e806100000006c3ee4069436d70710000000c8e72f00a6ec6c6f02000000000000001800000028c76c6fcce72f002823b26600005400000000000c00000028c76c6fd8e72f002f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000c4e82f006a6fc66600000000bc6fc666ad69b31f40e42f0000000000c0ee2f0015de04775d449a68feffffff7f670c77e2d8cf7628242b6f02000000000000001800000030a5ca5f84e82f002823b26600005400000000000c00000030a5ca5f90e82f002f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000090e82f006a6fc66600000000bc6fc666e169b31f0ce42f0000000000c0ee2f0015de04775d449a68feffffff7f670c77e2d8cf7628242b6f02000000000000001800000030a5ca5f50e82f002823b26600005400000000000c00000030a5ca5f5ce82f002f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100766004e506f0e9e506000000006004e506200000000000000058e72f0050dc68776004e5061000000014c8e60634c2d7071000000084e72f00a6ec6c6f02000000000000001800000028c76c6f88e72f002823b26600005400000000000c00000028c76c6f94e72f002f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008b389af696009e50600000000c0f14808a826af696009e50608f248080723ae696009e50620000000000000005c37ae6928120c0220823c0228120c020200000000000000180000000009e5060cf248082823b26600005400000000000c00000020823c0218f248082f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008b389af69500ae5060000000050f25a08a826af69500ae50698f25a080723ae69500ae50620000000000000005c37ae6928120c0220c23d0228120c02020000000000000018000000000ae5069cf25a082823b26600005400000000000c00000020c23d02a8f25a082f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076a014e806f0e9e50600000000a014e806100000000000000048e72f0050dc6877a014e8061000000014c8e606b4c2d7071000000074e72f00a6ec6c6f02000000000000001800000028c76c6f78e72f002823b26600005400000000000c00000028c76c6f84e72f002f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000094e82f006a6fc66600000000bc6fc666dd69b31f10e42f0000000000c0ee2f0015de04775d449a68feffffff7f670c77e2d8cf7628242b6f02000000000000001800000030a5ca5f54e82f002823b26600005400000000000c00000030a5ca5f60e82f002f99ca5f0c000000 (UID: 00000000-00002768) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310069c00de50600000000f8f05308a826af69c00de50644f153080723ae69c00de50620000000000000005c37ae6928120c0220823f0228120c0220823f020200000000000000180000004cf0699248f153082823b26600005400000000000c00000020823f0254f153082f99ca5f0c000000 (UID: 00000000-00002768)33:T67b,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")34:T6f8,"f7bce3836c364ecd1baa6686179edcea.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "f7bce3836c364ecd1baa6686179edcea.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Vx2jd75.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Vx2jd75.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Qy9FJ79.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Qy9FJ79.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "EC8cv45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "EC8cv45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1pt61fh6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1pt61fh6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2UP1413.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2UP1413.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "9Cn0FR9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "9Cn0FR9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")35:T505,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")36:T67b,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")37:T74a,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")38:T452,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")39:T519,"AppLaunch.exe" queries volume information of "C:\" at 00000000-00003652-0000010C-1021546 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00002768-0000010C-19860039 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002768-0000010C-47925233 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002768-0000010C-47943284 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002768-0000010C-57355644 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002768-0000010C-61919269 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002768-0000010C-712802543a:T6cc,"AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003652) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003652) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003652) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003652) "AppLaunch.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003652) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003652) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002768) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002768) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00002768) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00001928)3b:T4e29,"f7bce3836c364ecd1baa6686179edcea.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002844) "Vx2jd75.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003584) "Vx2jd75.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003584) "Qy9FJ79.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003380) "Qy9FJ79.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003380) "Qy9FJ79.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003380) "Qy9FJ79.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003380) "Qy9FJ79.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003380) "EC8cv45.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002960) "1pt61fh6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter %TEMP%\IXP003.TMP\1pt61fh6.exe (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00003864) "1pt61fh6.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00003864) "2UP1413.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002228) "2UP1413.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002228) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003652) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003652) "8dj938fe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002144) "8dj938fe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002144) "8dj938fe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002144) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002768) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00002768) "9Cn0FR9.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001832) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001928)3c:T16834,"f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002844) "f7bce3836c364ecd1baa6686179edcea.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002844) "Vx2jd75.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003584) "Vx2jd75.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003584) "Vx2jd75.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003584) "Qy9FJ79.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003380) "Qy9FJ79.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003380) "EC8cv45.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002960) "EC8cv45.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002960) "EC8cv45.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002960) "1pt61fh6.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003864) "1pt61fh6.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003864) "2UP1413.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002228) "2UP1413.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002228) "2UP1413.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002228) "2UP1413.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00002228) "2UP1413.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002228) "2UP1413.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002228) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003652) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003652) "7Lb76Cq.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000452) "7Lb76Cq.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000452) "8dj938fe.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002144) "8dj938fe.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00002144) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter __std_type_info_destroy_list (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter _free_base (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00002768) "AppLaunch.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00002768) "9Cn0FR9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001832) "9Cn0FR9.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001832) "9Cn0FR9.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001832) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetOpenW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpOpenRequestW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001928)3d:T141b,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00002960.00000B90.10030855936572896.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000452.00000000.67635.00380000.00000004.mdmp, 00000000-00000452.00000000.67635.00800000.00000004.mdmp, 00000000-00000452.00000000.67647.004F0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000452.00000000.67647.004F0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001832.00000001.69999.00220000.00000004.mdmp, 00000000-00001832.00000001.69999.004A0000.00000004.mdmp, 00000000-00001832.00000001.69999.004D0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001832.00000001.69999.00220000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00001832.00000001.69999.00220000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001832.00000001.69999.00220000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001832.00000001.69999.00220000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00001832.00000001.69999.004A0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000000.68256.001A0000.00000004.mdmp, 00000000-00002144.00000001.68730.001A0000.00000004.mdmp, 00000000-00002144.00000001.68730.00320000.00000004.mdmp, 00000000-00002144.00000001.68730.00760000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000001.68730.00320000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000001.68730.00320000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000001.68730.00320000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000001.68730.00760000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002228.00000000.67097.000E0000.00000004.mdmp, 00000000-00002228.00000000.67097.00250000.00000004.mdmp, 00000000-00002228.00000000.67106.00200000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002228.00000000.67097.000E0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00002228.00000000.67097.000E0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002228.00000000.67097.000E0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002228.00000000.67097.00250000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002844.00000000.65637.00390000.00000004.mdmp, 00000000-00002844.00000000.65637.003B0000.00000004.mdmp, 00000000-00002844.00000001.67559.00190000.00000004.mdmp, 00000000-00002844.00000002.69477.003B0000.00000004.mdmp, 00000000-00002844.00000003.70095.00190000.00000004.mdmp, 00000000-00002844.00000003.70095.00390000.00000004.mdmp, 00000000-00002844.00000003.70095.003B0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002844.00000000.65637.003B0000.00000004.mdmp, 00000000-00002844.00000002.69477.003B0000.00000004.mdmp, 00000000-00002844.00000003.70095.003B0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002844.00000000.65637.003B0000.00000004.mdmp, 00000000-00002844.00000002.69477.003B0000.00000004.mdmp, 00000000-00002844.00000003.70095.003B0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002844.00000001.67559.00190000.00000004.mdmp, 00000000-00002844.00000003.70095.00190000.00000004.mdmp")3e:T450,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")3f:T17f2c,Found reference to API (Indicator: "CheckTokenMembership"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "DecryptFileA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "FreeSid"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "EqualSid"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "RegCloseKey"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "FindNextFileA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "FindClose"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LocalAlloc"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "lstrcmpA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CompareStringA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetLastError"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "DeleteFileA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GlobalFree"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CloseHandle"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetProcAddress"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GlobalLock"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LocalFree"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "FreeLibrary"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "ReadFile"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SizeofResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "WriteFile"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetFileTime"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetFilePointer"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "FindResourceA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CreateMutexA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "FreeResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetVersion"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetTempPathA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CreateFileA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetEvent"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "TerminateThread"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetVersionExA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LockResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CreateThread"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "ResetEvent"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LoadResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "ExitProcess"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CreateProcessA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "FormatMessageA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CreateEventA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CharUpperA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "MessageBeep"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CharPrevA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "LoadStringA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CharNextA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "EnableWindow"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "ReleaseDC"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "PeekMessageA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SendMessageA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "MessageBoxA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "ShowWindow"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetWindowPos"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetDC"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetWindowRect"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "Sleep"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "TerminateProcess"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetTickCount"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "MulDiv"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "00000000-00002228.00000000.67097.00261000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "VirtualAlloc"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "InitializeSListHead"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "IsDebuggerPresent"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "RtlUnwind"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "SetLastError"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "EnterCriticalSection"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "LeaveCriticalSection"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "DeleteCriticalSection"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "TlsAlloc"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "TlsGetValue"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "TlsSetValue"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "TlsFree"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "LoadLibraryExW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "EncodePointer"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "RaiseException"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetStdHandle"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetModuleHandleExW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "HeapFree"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "HeapAlloc"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "HeapReAlloc"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "LCMapStringW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "FindFirstFileExW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "FindNextFileW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "IsValidCodePage"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetACP"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetOEMCP"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetCPInfo"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetCommandLineA"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetCommandLineW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "MultiByteToWideChar"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "WideCharToMultiByte"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "SetStdHandle"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetFileType"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetStringTypeW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetProcessHeap"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "HeapSize"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "FlushFileBuffers"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetConsoleMode"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "SetFilePointerEx"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "CreateFileW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "WriteConsoleW"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "DecodePointer"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API (Indicator: "GetWindowDC"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "SendMessage"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetClassName"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "ReleaseCapture"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetWindowLong"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "SetWindowLong"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "InsertMenuItem"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "ClientToScreen"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetScrollInfo"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "DrawMenuBar"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "LoadCursor"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "SetCursor"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetLogicalDrives"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetCursorPos"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetClientRect"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "BitBlt"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "WindowFromPoint"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetWindowText"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetSystemMenu"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "InsertMenu"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "FindWindow"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "DestroyWindow"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetDCEx"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "CreateWindowEx"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "MessageBox"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "RegisterHotKey"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "UnregisterHotKey"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "CreateDirectory"; File: "00002768.00000AD0.12169458.00402000.wprm") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExA"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentHwProfileW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetAdaptersInfo"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItem"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "LoadCursor"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "InsertMenu"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowEx"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00002144.00000001.68730.01198000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002844.00000003.70095.00F41000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002844.00000003.70095.00F41000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002844.00000003.70095.00F41000.00000020.mdmp")40:T4db,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")41:T5fa,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp")42:T4ea,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "f7bce3836c364ecd1baa6686179edcea.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")43:T655,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00003652.00000E44.1686558.00424000.wprm") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001832.00000000.69239.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D0000.00000002.mdmp, 00000000-00001832.00000001.69999.012D8000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002144.00000000.68256.01190000.00000002.mdmp, 00000000-00002144.00000001.68730.01190000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002228.00000000.67097.00270000.00000002.mdmp, 00000000-00002228.00000000.67106.00278000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002844.00000002.69477.00F4A000.00000002.mdmp")44:T5da,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: f7bce3836c364ecd1baa6686179edcea.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: f7bce3836c364ecd1baa6686179edcea.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: f7bce3836c364ecd1baa6686179edcea.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: f7bce3836c364ecd1baa6686179edcea.exe "System\CurrentControlSet\Control\Session Manager" in Source: 29428-17-0040256D "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001832.00000001.69999.00220000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002144.00000001.68730.00320000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002228.00000000.67097.000E0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002844.00000000.65637.003B0000.00000004.mdmp 00000000-00002844.00000002.69477.003B0000.00000004.mdmp 00000000-00002844.00000003.70095.003B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002844.00000003.70095.00F41000.00000020.mdmp45:T515,"\Sessions\1\BaseNamedObjects\IsoScope_d58_IESQMMUTEX_0_519" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3416" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_d58_IE_EarlyTabStart_0xfdc_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_d58_ConnHashTable<3416>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_d58_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_d58_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3780" "\Sessions\1\BaseNamedObjects\IsoScope_ec4_IE_EarlyTabStart_0xef8_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_ec4_ConnHashTable<3780>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_ec4_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_ec4_IESQMMUTEX_0_331"46:T128e,"f7bce3836c364ecd1baa6686179edcea.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "f7bce3836c364ecd1baa6686179edcea.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Qy9FJ79.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Qy9FJ79.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1pt61fh6.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1pt61fh6.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1pt61fh6.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "1pt61fh6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1pt61fh6.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "2UP1413.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "8dj938fe.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "8dj938fe.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "9Cn0FR9.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "winhttp.dll" - [base:69b544b4; Status:c0000135]47:T4d3,"f7bce3836c364ecd1baa6686179edcea.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Vx2jd75.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Qy9FJ79.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "EC8cv45.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "9Cn0FR9.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "8dj938fe.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2UP1413.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT48:T75e,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "f7bce3836c364ecd1baa6686179edcea.exe") Found string "CheckConnectionTempCookie347965910accounts.youtube.com/accounts/2147484752216601228831069472207441603831069472CheckConnectionTempCookie803329021accounts.youtube.com/accounts/2147484752219601228831069472210363478831069472" (Indicator: "youtube"; File: "VXHDX3HD.txt") Found string "CheckConnectionTempCookie482718175accounts.youtube.com/accounts/2147484752224594688031069470215047563031069470" (Indicator: "youtube"; File: "G043UYWO.txt") Found string "CheckConnectionTempCookie347965910accounts.youtube.com/accounts/2147484752216601228831069472207441603831069472" (Indicator: "youtube"; File: "VXY2VUJ0.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "NCP1U7DQ.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "function DynamicLink_PlayYouTubeVideoInline( elem, videoid )" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var youtubeurl = location.protocol + '//www.youtube.com/embed/' + videoid + '?showinfo=0&autohide=1&fs=1&hd=1&modestbranding=1&rel=0&showsearch=0&wmode=direct&autoplay=1';" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var wrapper = $J( '

', { 'class': 'dynamiclink_youtubeviewvideo' } );" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var embed_wrapper = $J( '

', { 'class' : 'dynamiclink_youtubeviewvideoembedded', 'frameborder' : '0' } );" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var iframeContent = $J( '