24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ad,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 347cfd6ac482… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 347cfd6ac482…. Malware family: Trojan.Generic. Threat score 100/100. 13/29 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win32.DropperX-gen.19893.9734.exe","applicationCategory":["peexe","executable"],"identifier":"347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":29},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T15ac,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "WriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")26:T6e7,Observed string: "\??\C:\WINDOWS\SysWOW64\Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007372.00000000.69628.00F27000.00000004.mdmp Observed string: "Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007372.00000000.69628.03340000.00000004.mdmp 00000000-00007372.00000001.71548.03340000.00000004.mdmp 00000000-00007372.00000002.73467.03340000.00000004.mdmp Observed string: ":\WINDOWS\SYSTEM32\Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007372.00000000.69628.03340000.00000004.mdmp 00000000-00007372.00000001.71548.03340000.00000004.mdmp 00000000-00007372.00000002.73467.03340000.00000004.mdmp Observed string: "??\C:\WINDOWS\SYSTEM32\Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007372.00000000.69628.03340000.00000004.mdmp 00000000-00007372.00000001.71548.03340000.00000004.mdmp 00000000-00007372.00000002.73467.03340000.00000004.mdmp Observed string: ":\Amsi.DLL" (Indicator: "amsi.dll") in Source: 00000000-00007372.00000000.69628.03340000.00000004.mdmp 00000000-00007372.00000001.71548.03340000.00000004.mdmp 00000000-00007372.00000002.73467.03340000.00000004.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00007372.00000000.69628.05770000.00000004.mdmp 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp 00000000-00007372.00000001.71548.05770000.00000004.mdmp 00000000-00007372.00000001.71548.059D1000.00000020.mdmp 00000000-00007372.00000001.71548.0E090000.00000004.mdmp 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp 00000000-00007372.00000002.73467.05770000.00000004.mdmp 00000000-00007372.00000002.73467.059D1000.00000020.mdmp 00000000-00007372.00000002.73467.0E090000.00000004.mdmp 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp27:T609,Found PE header "MZ" - Source: "00000000-00007372.00000000.69628.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000000.69628.059D0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000000.69628.7DF20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000000.69628.7DF70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000001.71548.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000001.71548.05770000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000001.71548.059D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000001.71548.7D880000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000001.71548.7DF20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000001.71548.7DF70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000002.73467.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000002.73467.05770000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000002.73467.059D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007372.00000002.73467.7DF70000.00000004.mdmp")28:T55e,"347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007372) "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007372)29:T47e,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp")2a:Ta2b,Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")2b:T478,"Software\Borland\Delphi\Locales" (Indicator: "\borland\delphi\locales") in Source: 347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632 "Software\Borland\Delphi\Locales" (Indicator: "\borland\delphi\locales") in Source: 00000000-00007372.00000000.69628.00401000.00000020.mdmp 00000000-00007372.00000000.69628.05770000.00000004.mdmp 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp 00000000-00007372.00000001.71548.00401000.00000020.mdmp 00000000-00007372.00000001.71548.05770000.00000004.mdmp 00000000-00007372.00000001.71548.059D1000.00000020.mdmp 00000000-00007372.00000001.71548.7D880000.00000004.mdmp 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp 00000000-00007372.00000002.73467.00401000.00000020.mdmp 00000000-00007372.00000002.73467.05770000.00000004.mdmp 00000000-00007372.00000002.73467.059D1000.00000020.mdmp 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp2c:Td68,"347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")2d:T727,"347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2e:Ta8b,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")2f:T446,Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")30:Tc97f,Found reference to API (Indicator: "GetLongPathNameA"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API (Indicator: "GetSystemMetrics"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API (Indicator: "AnimateWindow"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API (Indicator: "CoInitializeEx"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API (Indicator: "VirtualAlloc"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API (Indicator: "VirtualProtect"; File: "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632") Found reference to API (Indicator: "GetLongPathNameA"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API (Indicator: "AnimateWindow"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007372.00000000.69628.00401000.00000020.mdmp, 00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp, 00000000-00007372.00000001.71548.00401000.00000020.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7D880000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp, 00000000-00007372.00000002.73467.00401000.00000020.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "SysReAllocStringLen"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardType"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00007372.00000000.69628.006CE000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.006CE000.00000004.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.006CE000.00000004.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtAllocateVirtualMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtProtectVirtualMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtReadVirtualMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtSetSecurityObject"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Heap32ListFirst"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Heap32ListNext"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Heap32First"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Heap32Next"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Toolhelp32ReadProcessMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Module32FirstW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "Module32NextW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DA00000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7D710000.00000004.mdmp, 00000000-00007372.00000001.71548.7DA00000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7CFC0000.00000004.mdmp, 00000000-00007372.00000002.73467.7DA00000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtOpenProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateUserThread"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateQueryDebugBuffer"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtQueryDirectoryFile"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "RtlQueryProcessDebugInformation"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "EnumServicesStatusW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessAsUserA"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtQueryVirtualMemory"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtOpenSection"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtCreateSection"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySecurityObject"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")31:Tb00,Found string "cmd.exe /c start /min powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" & exit" (Indicator: "cmd.exe /c"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found string "cmd.exe /c mkdir "\\?\C:\Windows "" (Indicator: "cmd.exe /c"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found string "cmd.exe /c mkdir "\\?\C:\Windows \System32"" (Indicator: "cmd.exe /c"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found string "cmd.exe /c ECHO F|xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y" (Indicator: "cmd.exe /c"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found string "cmd.exe /c ECHO F|xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y" (Indicator: "cmd.exe /c"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found string "cmd.exe /c ECHO F|xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y" (Indicator: "cmd.exe /c"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")32:T444,Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "SxTracerGetThreadContextDebug" (Indicator: "GetThreadContext"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")33:T426,Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")34:T16b7,"SOFTWARE\Borland\Delphi\RTL" in Source: 347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632 "Software\Borland\Locales" in Source: 347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632 "Software\Borland\Delphi\Locales" in Source: 347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632 "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632 "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632 "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632 "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00007372.00000000.69628.00401000.00000020.mdmp 00000000-00007372.00000000.69628.05770000.00000004.mdmp 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp 00000000-00007372.00000001.71548.00401000.00000020.mdmp 00000000-00007372.00000001.71548.05770000.00000004.mdmp 00000000-00007372.00000001.71548.059D1000.00000020.mdmp 00000000-00007372.00000001.71548.7D880000.00000004.mdmp 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp 00000000-00007372.00000002.73467.00401000.00000020.mdmp 00000000-00007372.00000002.73467.05770000.00000004.mdmp 00000000-00007372.00000002.73467.059D1000.00000020.mdmp 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00007372.00000000.69628.00401000.00000020.mdmp 00000000-00007372.00000000.69628.05770000.00000004.mdmp 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp 00000000-00007372.00000001.71548.00401000.00000020.mdmp 00000000-00007372.00000001.71548.05770000.00000004.mdmp 00000000-00007372.00000001.71548.059D1000.00000020.mdmp 00000000-00007372.00000001.71548.7D880000.00000004.mdmp 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp 00000000-00007372.00000002.73467.00401000.00000020.mdmp 00000000-00007372.00000002.73467.05770000.00000004.mdmp 00000000-00007372.00000002.73467.059D1000.00000020.mdmp 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00007372.00000000.69628.00401000.00000020.mdmp 00000000-00007372.00000000.69628.05770000.00000004.mdmp 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp 00000000-00007372.00000001.71548.00401000.00000020.mdmp 00000000-00007372.00000001.71548.05770000.00000004.mdmp 00000000-00007372.00000001.71548.059D1000.00000020.mdmp 00000000-00007372.00000001.71548.7D880000.00000004.mdmp 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp 00000000-00007372.00000002.73467.00401000.00000020.mdmp 00000000-00007372.00000002.73467.05770000.00000004.mdmp 00000000-00007372.00000002.73467.059D1000.00000020.mdmp 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00007372.00000000.69628.00401000.00000020.mdmp 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp 00000000-00007372.00000001.71548.00401000.00000020.mdmp 00000000-00007372.00000001.71548.7D880000.00000004.mdmp 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp 00000000-00007372.00000002.73467.00401000.00000020.mdmp 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00007372.00000000.69628.00401000.00000020.mdmp 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp 00000000-00007372.00000001.71548.00401000.00000020.mdmp 00000000-00007372.00000001.71548.7D880000.00000004.mdmp 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp 00000000-00007372.00000002.73467.00401000.00000020.mdmp 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00007372.00000000.69628.00401000.00000020.mdmp 00000000-00007372.00000000.69628.7DF70000.00000004.mdmp 00000000-00007372.00000001.71548.00401000.00000020.mdmp 00000000-00007372.00000001.71548.7D880000.00000004.mdmp 00000000-00007372.00000001.71548.7DF70000.00000004.mdmp 00000000-00007372.00000002.73467.00401000.00000020.mdmp 00000000-00007372.00000002.73467.7DDA0000.00000004.mdmp 00000000-00007372.00000002.73467.7DF70000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1" in Source: 00000000-00007372.00000000.69628.03470000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007372.00000000.69628.05770000.00000004.mdmp 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp 00000000-00007372.00000001.71548.05770000.00000004.mdmp 00000000-00007372.00000001.71548.059D1000.00000020.mdmp 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp 00000000-00007372.00000002.73467.05770000.00000004.mdmp 00000000-00007372.00000002.73467.059D1000.00000020.mdmp 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp35:T88a,Found reference to API "EnumServicesStatusA" (Indicator: "EnumServicesStatus"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "EnumServicesStatusExA" (Indicator: "EnumServicesStatus"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007372.00000000.69628.05770000.00000004.mdmp, 00000000-00007372.00000000.69628.7DF20000.00000004.mdmp, 00000000-00007372.00000001.71548.05770000.00000004.mdmp, 00000000-00007372.00000001.71548.059D1000.00000020.mdmp, 00000000-00007372.00000001.71548.7DF20000.00000004.mdmp, 00000000-00007372.00000002.73467.05770000.00000004.mdmp, 00000000-00007372.00000002.73467.059D1000.00000020.mdmp, 00000000-00007372.00000002.73467.7DF20000.00000004.mdmp")36:T7df,"347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")37:Te16,"347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "347CFD6AC482E6562D6A8BB4029ED095936599EE3DE2498F91171C135F9B4632.EXE"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "")38:T655,"347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "C:\347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "\Device\HarddiskVolume2\347CFD6AC482E6562D6A8BB4029ED095936599EE3DE2498F91171C135F9B4632.EXE.LOCAL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "\Device\HarddiskVolume2\VERSION.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll"39:Td93,"347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\SAMCLI.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\347CFD6AC482E6562D6A8BB4029ED095936599EE3DE2498F91171C135F9B4632.ENU.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\347CFD6AC482E6562D6A8BB4029ED095936599EE3DE2498F91171C135F9B4632.EN.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\OLEPRO32.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Oracle\Java\javapath_target_114250\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\wbem\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\Wireshark\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files\mitmproxy\bin\ARCHIVEINT.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\WININET.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\AMSI.DLL" "347cfd6ac482e6562d6a8bb4029ed095936599ee3de2498f91171c135f9b4632.exe" trying to access non-existent file "\Device\HarddiskVolume2\USERENV.DLL"3a:T12db4,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007372.00000000.69628.03340000.00000004.mdmp") Found URL "http://www.pmail.comemailsupport@pmail.gen.nzvarfileinfotranslation!this" - Source: "00000000-00007372.00000000.69628.7DF20000.00000004.mdmp") Found URL "https://lounified" - Source: "00000000-00007372.00000001.71548.03340000.00000004.mdmp") Found URL "https://onedrive.live.com/download?resid=b2305aec3292e544%21113&authkey=!ae_byqk2svbac9sclsid\" - Source: "00000000-00007372.00000001.71548.03340000.00000004.mdmp") Found URL "https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=16&ct=1695831402&rver=7.3.6962.0&wp=mbi_ssl_shared&wreply=https:%2f%2fonedrive.live.com%2fdownload%3fresid%3db2305aec3292e544%2521113%26authkey%3d!ae_byqk2svbac9s&lc=1033&id=250206&cbcxt=sky&cbcxt=sky:\windows\system32\rsaenh.dllonfirm" - Source: "00000000-00007372.00000001.71548.03340000.00000004.mdmp") Found URL "https://live.com/registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ttps://login.live.com/ttps://login.live.com/registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ttps://login.live.com/ttps://login.live.com/ttps://login.live.com/ttps://login.live.com/registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ttps://login.live.com/registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=16&ct=1695831410&rver=7.3.6962.0&wp=mbi_ssl_shared&wreply=https:%2f%2fonedrive.live.com%2fdownload%3fresid%3db2305aec3292e544%2521113%26authkey%3d!ae_byqk2svbac9s&lc=1033&id=250206&cbcxt=sky&cbcxt=skywww.tm.v4.a.prd.aadg.trafficmanager.netlogin.live.comhttps://onedrive.live.com/download?resid=b2305aec3292e544%21113&authkey=!ae_byqk2svbac9sedrive.live.com/onedrive.live.comhttps://login.live.com/login.live.commicrosoft" - Source: "00000000-00007372.00000001.71548.03340000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007372.00000001.71548.03340000.00000004.mdmp") Found URL "https://acctcdn.msauth.net" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://acctcdn.msftauth.net" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msauth.net" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://acctcdn.msauth.net/" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://acctcdn.msftauth.net/" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://acctcdnmsftuswe2.azureedge.net/" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://acctcdnvzeuno.azureedge.net/" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msauth.net/" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msftauth.net/" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://lgincdnvzeuno.azureedge.net/" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://lgincdnmsftuswe2.azureedge.net/" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://login.live.com" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://login.live.com/jsdisabled.srf?mkt=en-us&lc=1033&uaid=53223127872a443f9903bd7826280e2e" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msauth.net/16.000.29890.11/images/favicon.ico" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msauth.net/16.000/converged_v21033_4hqsctf5ffstbmz0_eiqya2.css" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msauth.net/16.000.29890.11/images/windows_live_v_thumb.jpg" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://login.live.com/getsessionstate.srf?id=250206&mkt=en-us&lc=1033&uaid=53223127872a443f9903bd7826280e2e',bj:false,ck:2,cm:true,aa:false,cn:true,ab:true,urlpostmsa:'https://login.live.com/ppsecure/post.srf?id=250206&contextid=db94814090964076&opid=c0469474b11f168d&bk=1695831411&uaid=53223127872a443f9903bd7826280e2e&pid=0',bp:false,ad:true,d0:'https://go.microsoft.com/fwlink/?linkid=2013738',d1:'',af:0,bs:false,bu:true,ah:1,ct:false,ai:'',d4:'',d6:'https://go.microsoft.com/fwlink/?linkid=254486',cw:false,bx:false,al:'',cx:true,am:'',d9:'',urlreportpageload:'https://login.live.com/instrumentation.srf?actionid=15&mkt=en-us&lc=1033&uaid=53223127872a443f9903bd7826280e2e',b0:'',ar:'',as:'https://login.microsoft.com/consumers/fido/get?mkt=en-us&lc=1033&uiflavor=web',urllogin:'https://login.live.com/login.srf?id=250206&id=250206&contextid=db94814090964076&opid=c0469474b11f168d&bk=1695831411&mkt=en-us&lc=1033&uaid=53223127872a443f9903bd7826280e2e',fmmxqrnewdescription:true,at:'https://login.live.com/gls.srf?urlid=winlivetermsofuse&mkt=en-us&uaid=53223127872a443f9903bd7826280e2e',b5:'https://account.live.com/query.aspx?uaid=53223127872a443f9903bd7826280e2e&mkt=en-us&lc=1033&id=250206',av:'',db:'',hpgid:33,srequestcountry:'us',dc:'',a11yconformelink:null,b9:'https://account.live.com/changepassword?uaid=53223127872a443f9903bd7826280e2e',cf:'',fapplicationinsightsenabled:false,dh:'pa',ck:2,cl:true,dl:'',cm:true,urlfed:'',iapplicationinsightsenabledpercentage:0,bb:true,urlpostaad:'',do:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "http://explore.live.com/windows-live-sign-in-single-use-code-faq\" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://onedrive.live.com/preload?view=folders.all&id=250206&mkt=en-us',urlpost:'https://login.live.com/ppsecure/post.srf?id=250206&contextid=db94814090964076&opid=c0469474b11f168d&bk=1695831411&uaid=53223127872a443f9903bd7826280e2e&pid=0',at:'https://login.live.com/gls.srf?urlid=msnprivacystatement&mkt=en-us&uaid=53223127872a443f9903bd7826280e2e',av:'',bu:'',c5:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://account.live.com/resetpassword.aspx?wreply=https://login.live.com/login.srf%3fid%3d250206%26id%3d250206%26contextid%3ddb94814090964076%26opid%3dc0469474b11f168d%26bk%3d1695831411&id=250206&uiflavor=web&uaid=53223127872a443f9903bd7826280e2e&mkt=en-us&lc=1033&bk=1695831411',bi:true,dv:'https://sc.imp.live.com/content/dam/imp/surfaces/mail_signin/v3/sky/en-us.html?id=250206&mkt=en-us&cbcxt=sky',bj:true,dw:'',str:[],dx:'https://p.sfx.ms/login/v1/header.html?id=250206&mkt=en-us&cbcxt=sky',r:1033,a8:true,bm:3,bn:5,floadgamepadnavigationmodule:false,t:false,v:60,co:true,w:'https://account.live.com/username/recover?wreply=https://login.live.com/login.srf%3flc%3d1033%26id%3d250206%26mkt%3den-us%26id%3d250206%26contextid%3ddb94814090964076%26opid%3dc0469474b11f168d%26bk%3d1695831411%26uaid%3d53223127872a443f9903bd7826280e2e&id=250206&mkt=en-us&lc=1033&uaid=53223127872a443f9903bd7826280e2e&uiflavor=web',cp:false,x:'',cq:true,y:'https://login.live.com/cookiesdisabled.srf?uaid=53223127872a443f9903bd7826280e2e&mkt=en-us&lc=1033',cr:false,urlswitch:'https://login.live.com/logout.srf?id=250206&contextid=db94814090964076&opid=c0469474b11f168d&uaid=53223127872a443f9903bd7826280e2e&ru=https://onedrive.live.com/download%3fresid%3db2305aec3292e544%2521113%26authkey%3d!ae_byqk2svbac9s&bk=1695831411&lm=i',ab:0,bw:'ppft',urlfedconvertrename:'https://account.live.com/security/loginstage.aspx?lmif=1000&ru=https://login.live.com/login.srf%3fid%3d250206%26mkt%3den-us%26lc%3d1033%26uaid%3d53223127872a443f9903bd7826280e2e&mkt=en-us&lc=1033&cbid=0&id=250206&uaid=53223127872a443f9903bd7826280e2e',fisupdatedautocompleteenabled:true,cv:0,ad:'',af:'',bz:'',cz:1,ag:'',a:'https://logincdn.msauth.net/shared/1.0/',fallowlogintextcustomizations:true,b:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://signup.live.com/?id=250206&contextid=db94814090964076&opid=c0469474b11f168d&bk=1695831411&sru=https://login.live.com/login.srf%3fid%3d250206%26id%3d250206%26contextid%3ddb94814090964076%26opid%3dc0469474b11f168d%26mkt%3den-us%26lc%3d1033%26bk%3d1695831411%26uaid%3d53223127872a443f9903bd7826280e2e&uiflavor=web&lic=1&mkt=en-us&lc=1033&uaid=53223127872a443f9903bd7826280e2e',k:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://github.com/login/oauth/authorize?response_type=code&client_id=e37ffdec11c0245cb2e0&scope=read:user++user:email&redirect_uri=https://login.live.com/handlegithubresponse.srf&allow_signup=false&state=c0469474b11f168d',fimprovephonedisambig:true,correlationid:'53223127872a443f9903bd7826280e2e',opost:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msauth.net/','https://logincdn.msftauth.net/','https://lgincdnvzeuno.azureedge.net/','https://lgincdnmsftuswe2.azureedge.net/']" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://login.live.com/login.srf?id=250206&id=250206&contextid=db94814090964076&opid=c0469474b11f168d&mkt=en-us&lc=1033&bk=1695831411&uaid=53223127872a443f9903bd7826280e2e',a2:'prod',a3:true,ba:true,ca:'https://login.live.com/getcredentialtype.srf?opid=c0469474b11f168d&id=250206&id=250206&mkt=en-us&lc=1033&uaid=53223127872a443f9903bd7826280e2e',bb:false,cb:'https://account.live.com/resetpassword.aspx?wreply=https://login.live.com/login.srf%3fid%3d250206%26id%3d250206%26contextid%3ddb94814090964076%26opid%3dc0469474b11f168d%26bk%3d1695831411&id=250206&uiflavor=web&lostauthenticator=1&uaid=53223127872a443f9903bd7826280e2e&mkt=en-us&lc=1033&bk=1695831411',cc:'https://login.live.com/me.htm?v=3&uaid=53223127872a443f9903bd7826280e2e',cd:'https://go.microsoft.com/fwlink/p/?linkid=850749" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msauth.net/16.000/content/js/convergedloginpaginatedstrings.en_w2ql6jjxiaj3_foy9w2a-a2.js" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://logincdn.msauth.net/shared/1.0/content/js/convergedlogin_pcore_tsc0su-bb7jt0qvuf6v9cg2.js" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://login.live.com/jsdisabled.srf?mkt=en-us&lc=1033&uaid=6e8cfe9c3b7d4b74830343468589a647" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://login.live.com/getsessionstate.srf?id=250206&mkt=en-us&lc=1033&uaid=6e8cfe9c3b7d4b74830343468589a647',bj:false,ck:2,cm:true,aa:false,cn:true,ab:true,urlpostmsa:'https://login.live.com/ppsecure/post.srf?id=250206&contextid=3752944178e09d16&opid=338d0990d209b527&bk=1695831402&uaid=6e8cfe9c3b7d4b74830343468589a647&pid=0',bp:false,ad:true,d0:'https://go.microsoft.com/fwlink/?linkid=2013738',d1:'',af:0,bs:false,bu:true,ah:1,ct:false,ai:'',d4:'',d6:'https://go.microsoft.com/fwlink/?linkid=254486',cw:false,bx:false,al:'',cx:true,am:'',d9:'',urlreportpageload:'',b0:'',ar:'',as:'https://login.microsoft.com/consumers/fido/get?mkt=en-us&lc=1033&uiflavor=web',urllogin:'https://login.live.com/login.srf?id=250206&id=250206&contextid=3752944178e09d16&opid=338d0990d209b527&bk=1695831402&mkt=en-us&lc=1033&uaid=6e8cfe9c3b7d4b74830343468589a647',fmmxqrnewdescription:true,at:'https://login.live.com/gls.srf?urlid=winlivetermsofuse&mkt=en-us&uaid=6e8cfe9c3b7d4b74830343468589a647',b5:'https://account.live.com/query.aspx?uaid=6e8cfe9c3b7d4b74830343468589a647&mkt=en-us&lc=1033&id=250206',av:'',db:'',hpgid:33,srequestcountry:'us',dc:'',a11yconformelink:null,b9:'https://account.live.com/changepassword?uaid=6e8cfe9c3b7d4b74830343468589a647',cf:'',fapplicationinsightsenabled:false,dh:'passp',ck:2,cl:true,dl:'',cm:true,urlfed:'',iapplicationinsightsenabledpercentage:0,bb:true,urlpostaad:'',do:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://onedrive.live.com/preload?view=folders.all&id=250206&mkt=en-us',urlpost:'https://login.live.com/ppsecure/post.srf?id=250206&contextid=3752944178e09d16&opid=338d0990d209b527&bk=1695831402&uaid=6e8cfe9c3b7d4b74830343468589a647&pid=0',at:'https://login.live.com/gls.srf?urlid=msnprivacystatement&mkt=en-us&uaid=6e8cfe9c3b7d4b74830343468589a647',av:'',bu:'',c5:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://account.live.com/resetpassword.aspx?wreply=https://login.live.com/login.srf%3fid%3d250206%26id%3d250206%26contextid%3d3752944178e09d16%26opid%3d338d0990d209b527%26bk%3d1695831402&id=250206&uiflavor=web&uaid=6e8cfe9c3b7d4b74830343468589a647&mkt=en-us&lc=1033&bk=1695831402',bi:true,dv:'https://sc.imp.live.com/content/dam/imp/surfaces/mail_signin/v3/sky/en-us.html?id=250206&mkt=en-us&cbcxt=sky',bj:true,dw:'',str:[],dx:'https://p.sfx.ms/login/v1/header.html?id=250206&mkt=en-us&cbcxt=sky',r:1033,a8:true,bm:3,bn:5,floadgamepadnavigationmodule:false,t:false,v:60,co:true,w:'https://account.live.com/username/recover?wreply=https://login.live.com/login.srf%3flc%3d1033%26id%3d250206%26mkt%3den-us%26id%3d250206%26contextid%3d3752944178e09d16%26opid%3d338d0990d209b527%26bk%3d1695831402%26uaid%3d6e8cfe9c3b7d4b74830343468589a647&id=250206&mkt=en-us&lc=1033&uaid=6e8cfe9c3b7d4b74830343468589a647&uiflavor=web',cp:false,x:'',cq:true,y:'https://login.live.com/cookiesdisabled.srf?uaid=6e8cfe9c3b7d4b74830343468589a647&mkt=en-us&lc=1033',cr:false,urlswitch:'https://login.live.com/logout.srf?id=250206&contextid=3752944178e09d16&opid=338d0990d209b527&uaid=6e8cfe9c3b7d4b74830343468589a647&ru=https://onedrive.live.com/download%3fresid%3db2305aec3292e544%2521113%26authkey%3d!ae_byqk2svbac9s&bk=1695831402&lm=i',ab:0,bw:'ppft',urlfedconvertrename:'https://account.live.com/security/loginstage.aspx?lmif=1000&ru=https://login.live.com/login.srf%3fid%3d250206%26mkt%3den-us%26lc%3d1033%26uaid%3d6e8cfe9c3b7d4b74830343468589a647&mkt=en-us&lc=1033&cbid=0&id=250206&uaid=6e8cfe9c3b7d4b74830343468589a647',fisupdatedautocompleteenabled:true,cv:0,ad:'',af:'',bz:'',cz:1,ag:'',a:'https://logincdn.msauth.net/shared/1.0/',fallowlogintextcustomizations:true,b:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://signup.live.com/?id=250206&contextid=3752944178e09d16&opid=338d0990d209b527&bk=1695831402&sru=https://login.live.com/login.srf%3fid%3d250206%26id%3d250206%26contextid%3d3752944178e09d16%26opid%3d338d0990d209b527%26mkt%3den-us%26lc%3d1033%26bk%3d1695831402%26uaid%3d6e8cfe9c3b7d4b74830343468589a647&uiflavor=web&lic=1&mkt=en-us&lc=1033&uaid=6e8cfe9c3b7d4b74830343468589a647',k:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://github.com/login/oauth/authorize?response_type=code&client_id=e37ffdec11c0245cb2e0&scope=read:user++user:email&redirect_uri=https://login.live.com/handlegithubresponse.srf&allow_signup=false&state=338d0990d209b527',fimprovephonedisambig:true,correlationid:'6e8cfe9c3b7d4b74830343468589a647',opost:" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://login.live.com/login.srf?id=250206&id=250206&contextid=3752944178e09d16&opid=338d0990d209b527&mkt=en-us&lc=1033&bk=1695831402&uaid=6e8cfe9c3b7d4b74830343468589a647',a2:'prod',a3:true,ba:true,ca:'https://login.live.com/getcredentialtype.srf?opid=338d0990d209b527&id=250206&id=250206&mkt=en-us&lc=1033&uaid=6e8cfe9c3b7d4b74830343468589a647',bb:false,cb:'https://account.live.com/resetpassword.aspx?wreply=https://login.live.com/login.srf%3fid%3d250206%26id%3d250206%26contextid%3d3752944178e09d16%26opid%3d338d0990d209b527%26bk%3d1695831402&id=250206&uiflavor=web&lostauthenticator=1&uaid=6e8cfe9c3b7d4b74830343468589a647&mkt=en-us&lc=1033&bk=1695831402',cc:'https://login.live.com/me.htm?v=3&uaid=6e8cfe9c3b7d4b74830343468589a647',cd:'https://go.microsoft.com/fwlink/p/?linkid=850749" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://onedrive.live.com/download?resid=b2305aec3292e544%21113&authkey=!ae_byqk2svbac9shttps://onedrive.live.com/download?resid=b2305aec3292e544%21113&authkey=!ae_byqk2svbac9s@^@https://onedrive.live.com/download?resid=b2305aec3292e544%21113&authkey=!ae_byqk2svbac9s@^@link2@^@link3@^@" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://onedrive.live.com/download?resid=b2305aec3292e544%21113&authkey=!ae_byqk2svbac9s@^@link2@^@link3@^@" - Source: "00000000-00007372.00000001.71548.0E090000.00000004.mdmp") Found URL "https://live.com/https://live.com/https://live.com/:\windows\system32\userenv.dll:\windows\system32\userenv.dll:\windows\system32\userenv.dll:\windows\system32\userenv.dlln.srf?wa=wsignin1.0&rpsnv=16&ct=1695831410&rver=7.3.6962.0&wp=mbi_ssl_shared&wreply=https:%2f%2fonedrive.live.com%2fdownload%3fresid%3db2305aec3292e544%2521113%26authkey%3d!ae_byqk2svbac9s&lc=1033&id=250206&cbcxt=sky&cbcxt=skylogin.srf?wa=wsignin1.0&rpsnv=16&ct=1695831410&rver=7.3.6962.0&wp=mbi_ssl_shared&wreply=https:%2f%2fonedrive.live.com%2fdownload%3fresid%3db2305aec3292e544%2521113%26authkey%3d!ae_byqk2svbac9s&lc=1033&id=250206&cbcxt=sky&cbcxt=sky://login.live.com:443/login.srf?wa=wsignin1.0&rpsnv=16&ct=1695831410&rver=7.3.6962.0&wp=mbi_ssl_shared&wreply=https:%2f%2fonedrive.live.com%2fdownload%3fresid%3db2305aec3292e544%2521113%26authkey%3d!ae_byqk2svbac9s&lc=1033&id=250206&cbcxt=sky&cbcxt=skyttps://login.live.com/login.srf?wa=wsignin1.0&rpsnv=16&ct=1695831410&rver=7.3.6962.0&wp=mbi_ssl_shared&wreply=https:%2f%2fonedrive.live.com%2fdownload%3fresid%3db2305aec3292e544%2521113%26authkey%3d!ae_byqk2svbac9s&lc=1033&id=250206&cbcxt=sky&cbcxt=sky