34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 59:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4ab,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Generik.IJHXTUA trojan Sample 46e01d744d46… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 46e01d744d46…. Malware family: Generik.IJHXTUA trojan. Threat score 100/100. 1/24 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913","keywords":["Malicious","Generik.IJHXTUA trojan","malware analysis","sandbox report","threat intelligence","46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913"],"about":{"@type":"SoftwareApplication","name":"79ERS.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Generik.IJHXTUA trojan","antivirusDetections":{"malicious":1,"total":24},"behavioralIndicators":{"malicious":3,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T580,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000000.185345.178EE000.00000004.mdmp, 00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.178B8000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.178B8000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API "IAT.VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002484.00000000.185345.178EE000.00000004.mdmp, 00000000-00002484.00000001.187267.178B8000.00000004.mdmp, 00000000-00002484.00000002.189188.178B8000.00000004.mdmp")37:Tae5,Found reference to API "SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C90ED000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C90ED000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "`SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "TSetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyA" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00002484.00000001.187267.C90A5000.00000004.mdmp, 00000000-00002484.00000001.187267.D4564000.00000004.mdmp, 00000000-00002484.00000002.189188.D4564000.00000004.mdmp, 00000000-00002484.00000003.189784.C90A5000.00000004.mdmp, 00000000-00002484.00000003.189784.D4564000.00000004.mdmp") file/memory contains long string with (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp") file/memory contains long string with (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp") file/memory contains long string with (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp")38:T4b8,Found string "var j = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp") Found string "var j = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp") Found string "var _0x3bc248 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp") Found string "var _0x3bc248 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp")39:T66f,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_8086&DEV_7111&SUBSYS_197615AD&REV_01\3&18D45AA6&0&39") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_8086&DEV_7111&SUBSYS_197615AD&REV_01\3&18D45AA6&0&39") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\MSRRAS\MS_L2TPMINIPORT") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\MSRRAS\MS_L2TPMINIPORT") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\MSASN1") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96C-E325-11CE-BFC1-08002BE10318}") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000")3a:T8a2,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1388396377 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1388403407 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1388592448 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1388599670 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1388745564 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1388752273 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1389110514 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1389117239 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1389625476 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1389632142 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1391033713 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1391040218 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1391313078 [PID: 2484] "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" queried SystemProcessInformation at 00000000-00002484-00000C15-1391319968 [PID: 2484]3b:T31ed,Contains base64 string in header "/raw" in header "GET /raw HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: myexternalip.com" Contains base64 string in header "User" in header "GET /raw HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: myexternalip.com" Contains base64 string in header "like" in header "GET /raw HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: myexternalip.com" Contains base64 string in header "36Connection" in header "GET /raw HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: myexternalip.com" Contains base64 string in header "keep" in header "GET /raw HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: myexternalip.com" Contains base64 string in header "myexternalip" in header "GET /raw HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: myexternalip.com" Contains base64 string in header "/pkg/feed/health" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "0261ccdc9332" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "User" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "like" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "36Connection" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "keep" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "/pkg/feed/health" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "0261ccdc9332" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "User" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "like" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "36Connection" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "keep" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "/pkg/feed/health" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "0261ccdc9332" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "User" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "like" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "36Connection" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "keep" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: nightly-sun.cc" Contains base64 string in header "/s/spllcrash" in header "GET /s/spllcrash HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: t.me" Contains base64 string in header "User" in header "GET /s/spllcrash HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: t.me" Contains base64 string in header "like" in header "GET /s/spllcrash HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: t.me" Contains base64 string in header "36Connection" in header "GET /s/spllcrash HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: t.me" Contains base64 string in header "keep" in header "GET /s/spllcrash HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: t.me" Contains base64 string in header "/pkg/feed/health" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "0261ccdc9332" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "User" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "like" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "36Connection" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "keep" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "/pkg/feed/health" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "0261ccdc9332" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "User" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "like" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "36Connection" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "keep" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "/pkg/feed/health" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "0261ccdc9332" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "User" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "like" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "36Connection" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol" Contains base64 string in header "keep" in header "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Connection: keep-aliveHost: amm-frosty.lol"3c:T62b,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002484-00000C2C-1389097521") Found string "GetSystemFirmwareTable" (Indicator: "GetSystemFirmwareTable"; Source: "00000000-00002484-00000C2C-1389513883") Found string "EnumSystemFirmwareTables" (Indicator: "EnumSystemFirmwareTables"; Source: "00000000-00002484-00000C2C-1389516171") Found string "GetSystemFirmwareTable" (Indicator: "GetSystemFirmwareTable"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found string "EnumSystemFirmwareTables" (Indicator: "EnumSystemFirmwareTables"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") file/memory contains long string with (Indicator: "EnumSystemFirmwareTables"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp")3d:T40e,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002484.00000000.185345.178EE000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall." (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall null or undefined value" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp")3e:T5ce,Found string "xenvmmxenvmm ac97" (Indicator: "xenvmmxenvmm"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found string "xenvmmxenvmm" (Indicator: "xenvmmxenvmm"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D4610000.00000004.mdmp, 00000000-00002484.00000002.189188.D4610000.00000004.mdmp, 00000000-00002484.00000003.189784.D4610000.00000004.mdmp") Found string "vboxvboxvbox" (Indicator: "vboxvboxvbox"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D4610000.00000004.mdmp, 00000000-00002484.00000002.189188.D4610000.00000004.mdmp, 00000000-00002484.00000003.189784.D4610000.00000004.mdmp") Found string "kvmkvmkvm" (Indicator: "kvmkvmkvm"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D4610000.00000004.mdmp, 00000000-00002484.00000002.189188.D4610000.00000004.mdmp, 00000000-00002484.00000003.189784.D4610000.00000004.mdmp") Found string "KVMKVMKVM" (Indicator: "kvmkvmkvm"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D4610000.00000004.mdmp, 00000000-00002484.00000002.189188.D4610000.00000004.mdmp, 00000000-00002484.00000003.189784.D4610000.00000004.mdmp")3f:T5dc,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") file/memory contains long string with (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp") file/memory contains long string with (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp")40:Tae5,Found reference to API "SetupDiGetClassDevsA" (Indicator: "setupdigetclassdevs"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "setupdienumdeviceinfo"; Source: "00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C90ED000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C90ED000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "`SetupDiGetClassDevsA" (Indicator: "setupdigetclassdevs"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "TSetupDiEnumDeviceInfo" (Indicator: "setupdienumdeviceinfo"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyA" (Indicator: "setupdigetdeviceregistryproperty"; Source: "00000000-00002484.00000001.187267.C90A5000.00000004.mdmp, 00000000-00002484.00000001.187267.D4564000.00000004.mdmp, 00000000-00002484.00000002.189188.D4564000.00000004.mdmp, 00000000-00002484.00000003.189784.C90A5000.00000004.mdmp, 00000000-00002484.00000003.189784.D4564000.00000004.mdmp") file/memory contains long string with (Indicator: "setupdigetclassdevs"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp") file/memory contains long string with (Indicator: "setupdienumdeviceinfo"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp") file/memory contains long string with (Indicator: "setupdigetdeviceregistryproperty"; Source: "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp")41:Tabe,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000005f07fa7f0000504a05c961020000c8eb7f9ef80000000600000000000000c1da642efa7f000000000000000000000000000000000000b0e97f9ef8000000000000000000000000e97f9ef800000070d3722efa7f00000000000000000000f0d2722efa7f00000800000000000000d158632efa7f0000000000000000000020006000f8000000000000010000000000000000f80000000000000069002d00f800c72dfa7f000000000000000000006f00720065002d0000000000000000008029642efa7f00000100000065006100640073002d006c0031002d0031002d009399622efa7f00000000612efa7f000030fecb2dfa7f0000f0db00c9 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001799ef8000000a01d2ed46102000050000000000000000000000000000000000000000000000088be799ef8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000068be799ef800000000000000000000000000000000000000000000000000000000000000000000000000619df800000060c0799ef80000001891a20af67f000060d261d4610200007090a20af67f0000 (UID: 00000000-00002484)42:Te01,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter WSOCK32.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00002484)43:T3204,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetSystemFirmwareTable (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter EnumSystemFirmwareTables (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter K32EnumProcesses (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsA (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInfo (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyA (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RtlAddFunctionTable (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter SearchPathA (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter inet_pton (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002484) "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002484)44:T331e,Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002484.00000000.185345.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.17340000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.17340000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002484.00000000.185345.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.17340000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.17340000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002484.00000000.185345.17340000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.17340000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.17340000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API (Indicator: "K32EnumProcesses"; Source: "00000000-00002484.00000000.185345.17380000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.17380000.00000004.mdmp, 00000000-00002484.00000002.189188.17380000.00000004.mdmp, 00000000-00002484.00000003.189784.17380000.00000004.mdmp, 00000000-00002484.00000003.189784.D4630000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "SearchPathA"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002484.00000000.185345.17384000.00000004.mdmp, 00000000-00002484.00000000.185345.178EE000.00000004.mdmp, 00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.17384000.00000004.mdmp, 00000000-00002484.00000001.187267.178B8000.00000004.mdmp, 00000000-00002484.00000002.189188.17384000.00000004.mdmp, 00000000-00002484.00000002.189188.178B8000.00000004.mdmp, 00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00002484.00000000.185345.C9054000.00000004.mdmp") Found reference to API (Indicator: "EnumDateFormatsA"; Source: "00000000-00002484.00000000.185345.C9054000.00000004.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00002484.00000000.185345.C9054000.00000004.mdmp") Found reference to API (Indicator: "gethostname"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp") Found reference to API (Indicator: "GetSystemFirmwareTable"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemFirmwareTables"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevsA"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C9078000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C9078000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C9078000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.C90ED000.00000004.mdmp, 00000000-00002484.00000002.189188.C90ED000.00000004.mdmp, 00000000-00002484.00000003.189784.C90ED000.00000004.mdmp") Found reference to API (Indicator: "RtlAddFunctionTable"; Source: "00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.C90ED000.00000004.mdmp, 00000000-00002484.00000002.189188.C90ED000.00000004.mdmp, 00000000-00002484.00000003.189784.C90ED000.00000004.mdmp") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; Source: "00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.D4564000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C90ED000.00000004.mdmp, 00000000-00002484.00000002.189188.D4564000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C90ED000.00000004.mdmp, 00000000-00002484.00000003.189784.D4564000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.C90ED000.00000004.mdmp, 00000000-00002484.00000002.189188.C90ED000.00000004.mdmp, 00000000-00002484.00000003.189784.C90ED000.00000004.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00002484.00000000.185345.C90ED000.00000004.mdmp, 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C90ED000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.C90ED000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C90ED000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C90A5000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C90A5000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.D4610000.00000004.mdmp, 00000000-00002484.00000002.189188.D4610000.00000004.mdmp, 00000000-00002484.00000003.189784.D4610000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C90A5000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.C90A5000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4630000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyA"; Source: "00000000-00002484.00000001.187267.C90A5000.00000004.mdmp, 00000000-00002484.00000001.187267.D4564000.00000004.mdmp, 00000000-00002484.00000002.189188.D4564000.00000004.mdmp, 00000000-00002484.00000003.189784.C90A5000.00000004.mdmp, 00000000-00002484.00000003.189784.D4564000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002484.00000001.187267.C90A5000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.C90A5000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp")45:T1014,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000000.185345.178EE000.00000004.mdmp 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1" in Source: 00000000-00002484.00000000.185345.178EE000.00000004.mdmp "\??\C:\Users\vKoFa0a\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002484.00000000.185345.C9078000.00000004.mdmp "SOFTWARE\Microso" in Source: 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp "SOFTWARE\WOW6432" in Source: 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall." in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall null or undefined value" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallined value" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallue" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\USB" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000001.187267.D4564000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4564000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "C:\Users\vKoFa0a\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp 00000000-00002484.00000002.189188.D4564000.00000004.mdmp 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\disk\Enum" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp 00000000-00002484.00000002.189188.D4564000.00000004.mdmp 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Curre" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp 00000000-00002484.00000002.189188.D4564000.00000004.mdmp 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\W" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp 00000000-00002484.00000002.189188.D4564000.00000004.mdmp 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\US" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp 00000000-00002484.00000002.189188.D4564000.00000004.mdmp 00000000-00002484.00000003.189784.D4564000.00000004.mdmp46:T1818,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000000.185345.178EE000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1" in Source: 00000000-00002484.00000000.185345.178EE000.00000004.mdmp "\??\C:\Users\vKoFa0a\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002484.00000000.185345.C9078000.00000004.mdmp "SOFTWARE\Microso" in Source: 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp "SOFTWARE\WOW6432" in Source: 00000000-00002484.00000000.185345.D45DC000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall." in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall null or undefined value" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallined value" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallue" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\USB" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp "C:\Users\vKoFa0a\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\disk\Enum" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Curre" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\W" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\USB" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\US" in Source: 00000000-00002484.00000001.187267.D4564000.00000004.mdmp "SOFTWARE\Microso" in Source: 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp "SOFTWARE\WOW6432" in Source: 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall." in Source: 00000000-00002484.00000002.189188.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000002.189188.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall null or undefined value" in Source: 00000000-00002484.00000002.189188.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallined value" in Source: 00000000-00002484.00000002.189188.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallue" in Source: 00000000-00002484.00000002.189188.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000002.189188.D4408000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\USB" in Source: 00000000-00002484.00000002.189188.D4408000.00000004.mdmp "C:\Users\vKoFa0a\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002484.00000002.189188.D4408000.00000004.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002484.00000002.189188.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\disk\Enum" in Source: 00000000-00002484.00000002.189188.D4564000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Curre" in Source: 00000000-00002484.00000002.189188.D4564000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\W" in Source: 00000000-00002484.00000002.189188.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\USB" in Source: 00000000-00002484.00000002.189188.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\US" in Source: 00000000-00002484.00000002.189188.D4564000.00000004.mdmp "SOFTWARE\Microso" in Source: 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp "SOFTWARE\WOW6432" in Source: 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall." in Source: 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall null or undefined value" in Source: 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallined value" in Source: 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallue" in Source: 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\USB" in Source: 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "C:\Users\vKoFa0a\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\disk\Enum" in Source: 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Curre" in Source: 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\W" in Source: 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\USB" in Source: 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\US" in Source: 00000000-00002484.00000003.189784.D4564000.00000004.mdmp "SOFTWARE\Microso" in Source: 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp "SOFTWARE\WOW6432" in Source: 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp47:T23e0,"GET /raw HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Connection: keep-alive Host: myexternalip.com" Response ==> HTTP/1.1 200 OK Content-Length: 13 access-control-allow-origin: * content-type: text/plain; charset=utf-8 date: Fri 23 Oct 2026 18:51:39 GMT via: 1.1 google Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>36342E3132342E31322E313632....... "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:51:43 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=lzxjGzAn5xYimlX7kJdmwTlRtaGda2gqU9uQUsNyjl5z%2B%2BPSk5TI0pILHOwKBHzY6dkyd3kQses%2BnUMLzB2Dvh40CuYw7eaf7aEIU5GmT6u2i8Ul5FxMyZSnH4CyljAr4w%3D%3D"}]} CF-RAY: a4f2ef4a6ce0e9e7-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:51:45 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KWES4Xe6nNza2iuXy5GU6K877GgXBkDONdo6GTpavIuQfFfFrcOx9mnarfsPAGl5d%2B3L8UlgMlUrpmgk0NpCt5zi4LMKu3bTQzMXZKZ6q13td%2FOB1e97MudviEREV9Y19Q%3D%3D"}]} CF-RAY: a4f2ef5aaf95e9e7-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:51:50 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6s2i92IXmOAkCBdR84WDIOIVCnJ5cfr4jhnf2UAZzKRlUI4ddrtlAopjwpQG2hxxuGz2DjN0Xo5bdsrEdTa%2Bw%2BAOTF6t4fSeOcooXtt%2Fvj4XrU%2BbQ8WcFtMHnl0xfCDIpg%3D%3D"}]} CF-RAY: a4f2ef758aeae9e7-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:51:56 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vrE5l1VHl2RTQjI6EKV2LYFVg8%2Fu9lFWA2tpTJaGO25clBrfbJKjTtPMoVeichulnO%2BwhudxHepgCVfsMu0P3D6%2BguyptTY%2FrV%2FdWfdv0ds3JbfGo7qG3RP4JILWsuWBZg%3D%3D"}]} CF-RAY: a4f2ef9d4fd8e9e7-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:52:04 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bLrB%2B7FsXLkIY%2FbS4StQLUf9IcA4viZrj8yVOKnBNds1jZNtvMtb9ctDHhyMKAGzBULRltMeGExVBh%2BJ6l4osOu%2FJq1kAG0z%2BncjTNK1uFnZCkgyYwX1AFmkWSoc8DJstw%3D%3D"}]} CF-RAY: a4f2efd0e842e9e7-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /s/spllcrash HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Connection: keep-alive Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 23 Oct 2026 18:52:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 22108 Connection: keep-alive Set-Cookie: stel_ssid=82c825b325924df7ad_14324867328328263644; expires=Sat 24 Oct 2026 18:52:15 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:52:16 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=TOjNR2LgX2rZNCyjKNgZ1fbFaeO%2BT%2FbLpDmT%2BjMbrIc7LUK%2FITZN28vHJsuJEz3GYlxVf7%2BQTxAhAn1aVM0k3vYx%2BSEVSG7Su16fBI1JJtD%2Bwr4rnpS1MBM86mbC9Qt%2ByA%3D%3D"}]} CF-RAY: a4f2f017c96b78ff-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:52:18 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tj5fFMytPuazwsi3eDhFDOHIfdaSUHCE%2FQ%2F8BQpYcisIN57mUgPDdF%2B6Kz2x43fKsfE3rHyjiLCPa7aRnauXI8KM6028zTyhiKeHk03jOSo30aHN5qUadlpxorJVGvtjBg%3D%3D"}]} CF-RAY: a4f2f027fcab78ff-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:52:23 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BgPnXeKOBine%2FpHrLZ4ZscEvt9GAp2NSmra4Ls111kKjzW0N8yCvpniGPqZ%2FJ1P%2Bhs9cuUr2XiuIQi3uQkFGblISrkW%2BKO8fO9DlBCd9S%2FrYNZ%2FWRxTnWbZUUnS%2Bz8vMKQ%3D%3D"}]} CF-RAY: a4f2f0430f1878ff-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:52:29 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=u%2F33p0e%2FfLdeOteVgNSv2gq70%2FxNpe3KomiMPthJ7SXNh2QNT27Ur1zH0t%2BmDRWMLSoGNjnQJw1CW%2FbWhznqB8g6iwYaDcBysQXJlSCQX6fKDa3rr5rD0%2FT5w7ny7nzlHA%3D%3D"}]} CF-RAY: a4f2f06a4dda78ff-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol" Response ==> HTTP/1.1 404 Not Found Date: Fri 23 Oct 2026 18:52:37 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tWKg%2FmgzWJwkhtxSuDc3oSHrIhIBFKnN%2FQG4vsvNB%2FuAA%2Bv2MRpYoodVCfzQ8c8%2FhZiSCFJrJBG3DL1bmy3oTxR0G4pw5Po3L2VNs9u6kWvphvkTlyjyGqhI4rwF9ZF%2BTg%3D%3D"}]} CF-RAY: a4f2f09ebffc78ff-SJC alt-svc: h3=":443"; ma=86400 with no response body48:T119c,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa075f0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa2c180000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa2c180000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffa2c180000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa2c180000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "KERNEL32" at base 7ffa2c8d0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffa2c180000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffa2c180000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffa2c180000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "WINMM.DLL" at base 7ffa213e0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "KERNELBASE.DLL" at base 7ffa2c180000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffa29b30000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "POWRPROF.DLL" at base 7ffa2bb80000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffa2bca0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "WSOCK32.DLL" at base 7ffa1ff00000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa29620000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffa2b350000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "ADVAPI32.DLL" at base 7ffa2ccd0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa2ac70000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "KERNEL32.DLL" at base 7ffa2c8d0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "USER32.DLL" at base 7ffa2ce40000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "SETUPAPI.DLL" at base 7ffa2df90000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "IPHLPAPI.DLL" at base 7ffa2b030000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "RPCRT4.DLL" at base 7ffa2e4b0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "WS2_32.DLL" at base 7ffa2d0d0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffa16a30000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffa16970000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ffa13c70000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffa25f90000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffa15ed0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "BCRYPTPRIMITIVES" at base 7ffa2bca0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffa225f0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffa230c0000 "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ffa2c18000049:T583,The input sample is signed with a certificate issued by "CN=YR2, O=Let's Encrypt, C=US" (SHA1: 55:75:49:C6:E0:5A:2E:07:5F:1B:B8:81:4B:B8:09:57:E2:69:F2:6E; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: 2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information)4a:T556,"GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc" "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc" "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc" "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol" "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol" "GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol"4b:T637,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "")4c:T1216,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "")4d:T5a6,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to perform anti-VM checks using CPUID Matched sigs: Able to detect sandbox environment via user account Matched sigs: Able to identify virtual environment using sandbox registry Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Calls an API typically used to find device information Matched sigs: Calls an API typically used to enumerate device information Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM) Matched sigs: Contains ability to detect virtual environment Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to identify external IP address4e:T60b,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\USERENV.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\Windows\System32\userenv.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\WINDOWS\SYSTEM32\USERENV.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll"4f:T55c,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\USERENV.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\FLTLIB.DLL" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\MSVCP140.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\WINMM.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\WSOCK32.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\DEVOBJ.dll" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\MSASN1.dll"50:T5fe,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\bunfig.toml" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\98765.txt" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\Windows\System32\DriverStore\en-US\oem5.inf_loc" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\WINDOWS\System32\DriverStore\en-US\oem5.inf_loc" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\Windows\System32\DriverStore\en-US\oem12.inf_loc" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\WINDOWS\System32\DriverStore\en-US\oem12.inf_loc" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\Windows\System32\DriverStore\en-US\oem9.inf_loc" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\WINDOWS\System32\DriverStore\en-US\oem9.inf_loc" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\Windows\System32\DriverStore\en-US\tsusbhub.inf_loc" "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" trying to access non-existent file "C:\WINDOWS\System32\DriverStore\en-US\tsusbhub.inf_loc"51:Ta33,Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00002484-00000C2C-1389244121") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00002484.00000000.185345.C9078000.00000004.mdmp") file/memory contains long string with (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D5E60000.00000004.mdmp") Found reference to API "RAM socket #0" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #1" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #2" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #3" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #4" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #5" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #6" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #7" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #8" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #9" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #10" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #11" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #12" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #13" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "RAM socket #14" (Indicator: " socket "; Source: "00000000-00002484.00000000.185345.D6140000.00000004.mdmp") Found reference to API "getHostname" (Indicator: "gethostname"; Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp")52:Tb253,Found URL "https://github.com/oven-sh/bun/blob/main/src/runtime/api/ffi.h//" - Source: "00000000-00002484.00000000.185345.C909D000.00000004.mdmp") Found URL "https://github.com/oven-sh/webkit/blob/main/source/" - Source: "00000000-00002484.00000000.185345.C909D000.00000004.mdmp") Found URL "http://www.accv.esno" - Source: "00000000-00002484.00000001.187267.17384000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002484.00000001.187267.17384000.00000004.mdmp") Found URL "http://www.accv.es/legislacion_c.htm" - Source: "00000000-00002484.00000001.187267.17384000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002484.00000001.187267.17800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002484.00000001.187267.17800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002484.00000001.187267.17800000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/0s)kmue" - Source: "00000000-00002484.00000001.187267.17800000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crl0]h8/q" - Source: "00000000-00002484.00000001.187267.17800000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\*0a" - Source: "00000000-00002484.00000001.187267.17800000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0d-trust" - Source: "00000000-00002484.00000001.187267.17800000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0^ub96" - Source: "00000000-00002484.00000001.187267.17800000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/unitrust1uca" - Source: "00000000-00002484.00000001.187267.17843000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\0p1$0" - Source: "00000000-00002484.00000001.187267.17843000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cpsfuge,9xmiw)!h" - Source: "00000000-00002484.00000001.187267.178B0000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crllmemzldap://directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c=http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl8http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist8http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" - Source: "00000000-00002484.00000001.187267.178B0000.00000004.mdmp") Found URL "http://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl06wb/u%3" - Source: "00000000-00002484.00000001.187267.178B0000.00000004.mdmp") Found URL "http://www.accv.eslocal" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlizenpe" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://repository.swisssign.com/" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0lvuau+-6?e'qpztnq1" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl05zjd^nw)ocitvgkjuqgzxeeud4h" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.es0cghdlm" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esuuuuhmen" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/starfield" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crl" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0]0[uhttp://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0l1.0,%atos" - Source: "00000000-00002484.00000001.187267.178B8000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl0el4bt\c[..a$z]in" - Source: "00000000-00002484.00000001.187267.17946000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl0*'a+" - Source: "00000000-00002484.00000001.187267.17946000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl%seees1b0@9autoridad" - Source: "00000000-00002484.00000001.187267.C9054000.00000004.mdmp") Found URL "http://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00002484.00000001.187267.C9054000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0u" - Source: "00000000-00002484.00000001.187267.C90ED000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmnonic" - Source: "00000000-00002484.00000001.187267.C90ED000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0+0)" - Source: "00000000-00002484.00000001.187267.C90ED000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlnykiadk" - Source: "00000000-00002484.00000001.187267.C90ED000.00000004.mdmp") Found URL "https://amm-frosty.lol170zlhjdmvxd3dzbmhpwjbasfdny0wc98zlhjdmvxd3dzbmhpwjbasfdny0w298zlhjdmvxd3dzbmhpwjbasfdny0w300zlhjdmvxd3dzbmhpwjbasfdny0wl50zlhjdmvxd3dzbmhpwjbasfdny0w+" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://cold-signal.pw" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lol%77%72%69%74%65%49%6e%74%33%32%4c%45fallback_token_ok%46%77%39%62%55%41%77%54%51%67%3d%3dyhe4dhcgdgggkm9jnxlqnq==%38%33%63%30%63%65%63%34%33%62%36%65ywujymxjomb3ys1kbw83d2fhqkjlsvg=ywujymxjomb3ys1kbw83d2fhqkjlsvg=%38%63%36%62%34%33%34%64%32%30%62%0d%0a%55%73%65%72%2d%41%67%65%6e%74%3a%20%4d%45%4d%4c%4f%41%44%5f%4c%4f%47%20%6e%3d170wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq98wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%52%45%50%4f%52%54%5f%53%45%43%52%45%54298wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq300wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq50wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq230wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%45%58%45%43%5f%54%48%52%4f%57%3d189wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%73%65%74%41%75%74%68%54%61%67312wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq+251wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq196wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq125wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%46%41%4c%4c%42%41%43%4b%5f%45%52%52%20https://bears-speed.lol%38%33%63%30%63%65%63%34%33%62%36%65%2e%2f%72%65%67%69%73%74%72%79%37%65%63%68%61%72%43%6f%64%65%41%74fallback_reserve_ok" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cc%30%30%61%38%38%61%30%37%64%66mnr1jc4jzws4pdv0dyvdfvjwewzb%77%72%69%74%65%46%69%6c%65%53%79%6e%63icmiyj00mj51njzgbq0=%2e%2f%72%65%67%69%73%74%72%79%37%65%4e%4f%5f%54%4f%4b%45%4e%5f%45%58%49%54%54%56%64%65%58%6c%64%4f%57%77%3d%3d%77%72%69%74%65%55%49%6e%74%31%36%4c%45telemetry_err" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://ip.seeip.orgt170revdullqvf9et05fig1vzhvszt0%34%33%37%33%36%39%6e%7a%79%49%79%59hv98revdullqvf9et05fig1vzhvszt0%38%31%36%36%32%44%42%4f%4d%79%63298revdullqvf9et05fig1vzhvszt0300revdullqvf9et05fig1vzhvszt0%31%31%30%33%32%32%38%4d%52%71%4e%73%47x650revdullqvf9et05fig1vzhvszt0230revdullqvf9et05fig1vzhvszt0%33%34%38%37%32%37%32%71%55%68%41%70%74189revdullqvf9et05fig1vzhvszt0312revdullqvf9et05fig1vzhvszt0%31%30%39%36%30%33%32%53%4a%77%52%59%6a;251revdullqvf9et05fig1vzhvszt0%34%32%32%39%30%35%35%56%76%6c%6a%42%49196revdullqvf9et05fig1vzhvszt0%37%36%32%37%33%30%6b%65%72%4a%73%59125revdullqvf9et05fig1vzhvszt0=ad149revdullqvf9et05fig1vzhvszt0q202revdullqvf9et05fig1vzhvszt0g180revdullqvf9et05fig1vzhvszt0%66%72%6f%6d%43%68%61%72%43%6f%64%65308revdullqvf9et05fig1vzhvszt0%63%68%61%72%43%6f%64%65%41%74253revdullqvf9et05fig1vzhvszt0u212revdullqvf9et05fig1vzhvszt0webrequestorresponsehasbodyvalue,emiterrornexttickiferrorlistenerntemiterrornexttickiferrorlistenergetisnextincomingmessagehttpsr" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://nightly-sun.ccjgn11revdullqvf9et05fig1vzhvszt0f7c66bb9887a6ccac7f8b16e104f3d8f10revdullqvf9et05fig1vzhvszt0bgadafvuuvjwbg8cuadubf5xbwdvbvec29revdullqvf9et05fig1vzhvszt0%37%35%62%66%62%61%66%62%65%3153revdullqvf9et05fig1vzhvszt0%30%32%36%31%63%63%64%63%39%33%33%32119revdullqvf9et05fig1vzhvszt0zab275revdullqvf9et05fig1vzhvszt0%2f%70%6b%67%2f%6e%6f%64%65%2f%62%6c%6f%62l110revdullqvf9et05fig1vzhvszt0tflcrbdacg1ghevaavvbqa==%63%38%32%34%38%33%64%64%32%33%36%35s60revdullqvf9et05fig1vzhvszt0s!2103revdullqvf9et05fig1vzhvszt0132revdullqvf9et05fig1vzhvszt0u1ejuwubaaygw1qhxqseal4eal8fugqi136revdullqvf9et05fig1vzhvszt0324revdullqvf9et05fig1vzhvszt06160revdullqvf9et05fig1vzhvszt0https://cold-signal.pw326revdullqvf9et05fig1vzhvszt0https://iron-pulse.cc182revdullqvf9et05fig1vzhvszt0https://amm-frosty.lol166revdullqvf9et05fig1vzhvszt0https://bears-speed.loli4333revdullqvf9et05fig1vzhvszt0fxivewwwynhiz0zhwgcl23revdullqvf9et05fig1vzhvszt0e310revdullqvf9et05fig1vzhvszt0%54%56%64%65%58%6c%64%4f%57%77%3d%3ddrelbte9hx0vsuiasumxoewzsndauke9pdqpvc2vylufnzw50oiay2hhcknvzgvbdavfzkzvhsze9xdz09dg9ju09tdhjpbmcmta5njazmlnkd1jzagu2vszwn0t2jqzwn0yxbwzw5krmlszvn5bmmntc1nmyzytfmna0tvcmfuzg9tqnl0zxmahr0chm6ly9pcm9ulxb1bhnllmnj%72%65%73%74%6f%72%65%45%50restoreepno_payload_exitno_payload_exit%73%75%62%73%74%72%69%6e%67substring%62%61%73%65%36%34base64%72%65%6a%65%63%74reject00a88a07df%65%62%32%66%31%66eb2f1f%63%62%32%61%37%33%31%30cb2a7310tflcrbdacg1ghevaavvbqa==tflcrbdacg1ghevatflcrbdacg1ghevaavvbqa==https://ident.mehttps://ident.me%45%4e%44%50%4f%49%4e%54%53endpoints%41%56%56%42%42%41%3d%3davvbba==createhash%44%65%6c%65%74%65%44%43deletedc%63%61%74%63%68catchc64c%33%41%58%75%48%50%473axuhpgstatus_resp" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lol%73%63%6f%72%65score%6e%75%6d%62%65%72number%73%75%62%73%74%72%69%6e%67substring%77%72%69%74%65writeb3ed%70%61%72%73%65parsefallback_status_err" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://cold-signal.pwhttps://cold-sighttps://cold-signal.pw]98n2q5ytmxmwe1odjl%34%62%38%64%66%64%62%324b8dfdb2c-" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lol312q09nuefux0zbsuwgc2nvcmu9writeint32le251q09nuefux0zbsuwgc2nvcmu9%39%38%37%36%35%2e%74%78%7498765.txt196q09nuefux0zbsuwgc2nvcmu9%33%35%77%5a%67%77%70%7435wzgwpt125q09nuefux0zbsuwgc2nvcmu9fallback_token_okfallback_token_ofallback_token_okfw9buawtqg==yhe4dhcgdgggkm9jnxlqnq==yhe4dhcgdgggkm9jyhe4dhcgdgggkm9jnxlqnq==%73%65%61%72%63%68search83c0cec43b6e%46%42%55%44%41%41%3d%3dfbudaa==ywujymxjomb3ys1k8c6b434d20buser-agent:" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://bears-speed.lolhttps://bears-sphttps://bears-speed.lol%4d%42%20%7c%20mb" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cchttps://nightly-https://nightly-sun.cc5298y3jlyxrlq2lwagvyaxy%70%72%6f%74%6f%63%6f%6cprotocoln300y3jlyxrlq2lwagvyaxy00a88a07df50y3jlyxrlq2lwagvyaxy%36%62%66%63%61%656bfcaeg230y3jlyxrlq2lwagvyaxymnr1jc4jzws4pdv0dyvdfvjwewzbmnr1jc4jzws4pdv0pe189y3jlyxrlq2lwagvyaxy%43%4f%4e%4e%45%43%54%20connect" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://ip.seeip.orghttps://ip.seeiphttps://ip.seeip.org125s1hzc0xhchljalvuy0y0pq%41%55%46%42%58%52%45%3daufbxre=437369nzyiyy81662dbomyc%33%41%58%75%48%50%473axuhpg1103228mrqnsg1103228mrqnsg%31%35%45%67%48%78%67%7415eghxgt3487272quhapt3487272quhapt%33%35%77%5a%67%77%70%7435wzgwpt1096032sjwryj1096032sjwryj4229055vvljbi4229055vvljbi762730kerjsy%32%35%33%79%71%43%68%6c%61253yqchla%6c%65%6e%67%74%68lengthpushfromcharcodecharcodeatjoinmu3" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cchttps://nightly-https://nightly-sun.ccf7c66bb9887a6ccabgadafvuuvjwbg8c75bfbafbe10261ccdc9332/pkg/feed/health/pkg/feed/health/pkg/node/blob/pkg/node/blobtflcrbdacg1ghevaavvbqa==tflcrbdacg1ghevatflcrbdacg1ghevaavvbqa==4revdullqvf9et05fig1vzhvszt0c82483dd2365lybd/app/init/submit%75%6e%64%65%66%69%6e%65%64undefinedu1ejuwubaaygw1qh%30%33%38%30%61%39%330380a93%73%70%6c%6c%63%72%61%73%68spllcrashhttps://cold-signal.pwhttps://cold-sighttps://cold-signal.pwhttps://iron-pulse.cchttps://iron-pulhttps://iron-pulse.cchttps://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lolhttps://bears-speed.lolhttps://bears-sphttps://bears-speed.lolfxivewwwynhiz0zhwgclfxivewwwynhiz0zhfxivewwwynhiz0zhwgcl%30%33%66%37%33%63%36%3903f73c69" - Source: "00000000-00002484.00000001.187267.D4408000.00000004.mdmp") Found URL "https://bun.com/docs/project/licensingvarfileinfotranslationqm[pv" - Source: "00000000-00002484.00000002.189188.1794C000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0lvuau+-6?e'qpztnq1" - Source: "00000000-00002484.00000002.189188.1794C000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00002484.00000002.189188.1794C000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl%seees1b0@9autoridad" - Source: "00000000-00002484.00000002.189188.C9054000.00000004.mdmp") Found URL "http://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00002484.00000002.189188.C9054000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0u" - Source: "00000000-00002484.00000002.189188.C90ED000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmnonic" - Source: "00000000-00002484.00000002.189188.C90ED000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0+0)" - Source: "00000000-00002484.00000002.189188.C90ED000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlnykiadk" - Source: "00000000-00002484.00000002.189188.C90ED000.00000004.mdmp") Found URL "https://amm-frosty.lol170zlhjdmvxd3dzbmhpwjbasfdny0wc98zlhjdmvxd3dzbmhpwjbasfdny0w298zlhjdmvxd3dzbmhpwjbasfdny0w300zlhjdmvxd3dzbmhpwjbasfdny0wl50zlhjdmvxd3dzbmhpwjbasfdny0w+" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://cold-signal.pw" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lol%77%72%69%74%65%49%6e%74%33%32%4c%45fallback_token_ok%46%77%39%62%55%41%77%54%51%67%3d%3dyhe4dhcgdgggkm9jnxlqnq==%38%33%63%30%63%65%63%34%33%62%36%65ywujymxjomb3ys1kbw83d2fhqkjlsvg=ywujymxjomb3ys1kbw83d2fhqkjlsvg=%38%63%36%62%34%33%34%64%32%30%62%0d%0a%55%73%65%72%2d%41%67%65%6e%74%3a%20%4d%45%4d%4c%4f%41%44%5f%4c%4f%47%20%6e%3d170wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq98wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%52%45%50%4f%52%54%5f%53%45%43%52%45%54298wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq300wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq50wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq230wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%45%58%45%43%5f%54%48%52%4f%57%3d189wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%73%65%74%41%75%74%68%54%61%67312wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq+251wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq196wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq125wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%46%41%4c%4c%42%41%43%4b%5f%45%52%52%20https://bears-speed.lol%38%33%63%30%63%65%63%34%33%62%36%65%2e%2f%72%65%67%69%73%74%72%79%37%65%63%68%61%72%43%6f%64%65%41%74fallback_reserve_ok" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cc%30%30%61%38%38%61%30%37%64%66mnr1jc4jzws4pdv0dyvdfvjwewzb%77%72%69%74%65%46%69%6c%65%53%79%6e%63icmiyj00mj51njzgbq0=%2e%2f%72%65%67%69%73%74%72%79%37%65%4e%4f%5f%54%4f%4b%45%4e%5f%45%58%49%54%54%56%64%65%58%6c%64%4f%57%77%3d%3d%77%72%69%74%65%55%49%6e%74%31%36%4c%45telemetry_err" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://ip.seeip.orgt170revdullqvf9et05fig1vzhvszt0%34%33%37%33%36%39%6e%7a%79%49%79%59hv98revdullqvf9et05fig1vzhvszt0%38%31%36%36%32%44%42%4f%4d%79%63298revdullqvf9et05fig1vzhvszt0300revdullqvf9et05fig1vzhvszt0%31%31%30%33%32%32%38%4d%52%71%4e%73%47x650revdullqvf9et05fig1vzhvszt0230revdullqvf9et05fig1vzhvszt0%33%34%38%37%32%37%32%71%55%68%41%70%74189revdullqvf9et05fig1vzhvszt0312revdullqvf9et05fig1vzhvszt0%31%30%39%36%30%33%32%53%4a%77%52%59%6a;251revdullqvf9et05fig1vzhvszt0%34%32%32%39%30%35%35%56%76%6c%6a%42%49196revdullqvf9et05fig1vzhvszt0%37%36%32%37%33%30%6b%65%72%4a%73%59125revdullqvf9et05fig1vzhvszt0=ad149revdullqvf9et05fig1vzhvszt0q202revdullqvf9et05fig1vzhvszt0g180revdullqvf9et05fig1vzhvszt0%66%72%6f%6d%43%68%61%72%43%6f%64%65308revdullqvf9et05fig1vzhvszt0%63%68%61%72%43%6f%64%65%41%74253revdullqvf9et05fig1vzhvszt0u212revdullqvf9et05fig1vzhvszt0webrequestorresponsehasbodyvalue,emiterrornexttickiferrorlistenerntemiterrornexttickiferrorlistenergetisnextincomingmessagehttpsr" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://nightly-sun.ccjgn11revdullqvf9et05fig1vzhvszt0f7c66bb9887a6ccac7f8b16e104f3d8f10revdullqvf9et05fig1vzhvszt0bgadafvuuvjwbg8cuadubf5xbwdvbvec29revdullqvf9et05fig1vzhvszt0%37%35%62%66%62%61%66%62%65%3153revdullqvf9et05fig1vzhvszt0%30%32%36%31%63%63%64%63%39%33%33%32119revdullqvf9et05fig1vzhvszt0zab275revdullqvf9et05fig1vzhvszt0%2f%70%6b%67%2f%6e%6f%64%65%2f%62%6c%6f%62l110revdullqvf9et05fig1vzhvszt0tflcrbdacg1ghevaavvbqa==%63%38%32%34%38%33%64%64%32%33%36%35s60revdullqvf9et05fig1vzhvszt0s!2103revdullqvf9et05fig1vzhvszt0132revdullqvf9et05fig1vzhvszt0u1ejuwubaaygw1qhxqseal4eal8fugqi136revdullqvf9et05fig1vzhvszt0324revdullqvf9et05fig1vzhvszt06160revdullqvf9et05fig1vzhvszt0https://cold-signal.pw326revdullqvf9et05fig1vzhvszt0https://iron-pulse.cc182revdullqvf9et05fig1vzhvszt0https://amm-frosty.lol166revdullqvf9et05fig1vzhvszt0https://bears-speed.loli4333revdullqvf9et05fig1vzhvszt0fxivewwwynhiz0zhwgcl23revdullqvf9et05fig1vzhvszt0e310revdullqvf9et05fig1vzhvszt0%54%56%64%65%58%6c%64%4f%57%77%3d%3ddrelbte9hx0vsuiasumxoewzsndauke9pdqpvc2vylufnzw50oiay2hhcknvzgvbdavfzkzvhsze9xdz09dg9ju09tdhjpbmcmta5njazmlnkd1jzagu2vszwn0t2jqzwn0yxbwzw5krmlszvn5bmmntc1nmyzytfmna0tvcmfuzg9tqnl0zxmahr0chm6ly9pcm9ulxb1bhnllmnj%72%65%73%74%6f%72%65%45%50restoreepno_payload_exitno_payload_exit%73%75%62%73%74%72%69%6e%67substring%62%61%73%65%36%34base64%72%65%6a%65%63%74reject00a88a07df%65%62%32%66%31%66eb2f1f%63%62%32%61%37%33%31%30cb2a7310tflcrbdacg1ghevaavvbqa==tflcrbdacg1ghevatflcrbdacg1ghevaavvbqa==https://ident.mehttps://ident.me%45%4e%44%50%4f%49%4e%54%53endpoints%41%56%56%42%42%41%3d%3davvbba==createhash%44%65%6c%65%74%65%44%43deletedc%63%61%74%63%68catchc64c%33%41%58%75%48%50%473axuhpgstatus_resp" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lol%73%63%6f%72%65score%6e%75%6d%62%65%72number%73%75%62%73%74%72%69%6e%67substring%77%72%69%74%65writeb3ed%70%61%72%73%65parsefallback_status_err" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://cold-signal.pwhttps://cold-sighttps://cold-signal.pw]98n2q5ytmxmwe1odjl%34%62%38%64%66%64%62%324b8dfdb2c-" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lol312q09nuefux0zbsuwgc2nvcmu9writeint32le251q09nuefux0zbsuwgc2nvcmu9%39%38%37%36%35%2e%74%78%7498765.txt196q09nuefux0zbsuwgc2nvcmu9%33%35%77%5a%67%77%70%7435wzgwpt125q09nuefux0zbsuwgc2nvcmu9fallback_token_okfallback_token_ofallback_token_okfw9buawtqg==yhe4dhcgdgggkm9jnxlqnq==yhe4dhcgdgggkm9jyhe4dhcgdgggkm9jnxlqnq==%73%65%61%72%63%68search83c0cec43b6e%46%42%55%44%41%41%3d%3dfbudaa==ywujymxjomb3ys1k8c6b434d20buser-agent:" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://bears-speed.lolhttps://bears-sphttps://bears-speed.lol%4d%42%20%7c%20mb" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cchttps://nightly-https://nightly-sun.cc5298y3jlyxrlq2lwagvyaxy%70%72%6f%74%6f%63%6f%6cprotocoln300y3jlyxrlq2lwagvyaxy00a88a07df50y3jlyxrlq2lwagvyaxy%36%62%66%63%61%656bfcaeg230y3jlyxrlq2lwagvyaxymnr1jc4jzws4pdv0dyvdfvjwewzbmnr1jc4jzws4pdv0pe189y3jlyxrlq2lwagvyaxy%43%4f%4e%4e%45%43%54%20connect" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://ip.seeip.orghttps://ip.seeiphttps://ip.seeip.org125s1hzc0xhchljalvuy0y0pq%41%55%46%42%58%52%45%3daufbxre=437369nzyiyy81662dbomyc%33%41%58%75%48%50%473axuhpg1103228mrqnsg1103228mrqnsg%31%35%45%67%48%78%67%7415eghxgt3487272quhapt3487272quhapt%33%35%77%5a%67%77%70%7435wzgwpt1096032sjwryj1096032sjwryj4229055vvljbi4229055vvljbi762730kerjsy%32%35%33%79%71%43%68%6c%61253yqchla%6c%65%6e%67%74%68lengthpushfromcharcodecharcodeatjoinmu3" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cchttps://nightly-https://nightly-sun.ccf7c66bb9887a6ccabgadafvuuvjwbg8c75bfbafbe10261ccdc9332/pkg/feed/health/pkg/feed/health/pkg/node/blob/pkg/node/blobtflcrbdacg1ghevaavvbqa==tflcrbdacg1ghevatflcrbdacg1ghevaavvbqa==4revdullqvf9et05fig1vzhvszt0c82483dd2365lybd/app/init/submit%75%6e%64%65%66%69%6e%65%64undefinedu1ejuwubaaygw1qh%30%33%38%30%61%39%330380a93%73%70%6c%6c%63%72%61%73%68spllcrashhttps://cold-signal.pwhttps://cold-sighttps://cold-signal.pwhttps://iron-pulse.cchttps://iron-pulhttps://iron-pulse.cchttps://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lolhttps://bears-speed.lolhttps://bears-sphttps://bears-speed.lolfxivewwwynhiz0zhwgclfxivewwwynhiz0zhfxivewwwynhiz0zhwgcl%30%33%66%37%33%63%36%3903f73c69" - Source: "00000000-00002484.00000002.189188.D4408000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00002484.00000002.189188.D5380000.00000004.mdmp") Found URL "https://t.me/spllcrash" - Source: "00000000-00002484.00000002.189188.D5800000.00000004.mdmp") Found URL "https://t.me/spllcrash/1" - Source: "00000000-00002484.00000002.189188.D5800000.00000004.mdmp") Found URL "http://www.accv.esno" - Source: "00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=twkg%2fmgzwjwkhtxsudc3oshrihibfknn%2fqg4vsvnb%2fuaa%2bv2mrpyoodvcfzq8c8%2fhziscfjrjbg3dl1bmy3otxr0g4pw5po3l2vns9u6kwvphvktlyjygqhi4rwf9zf%2btg%3d%3d" - Source: "00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found URL "http://www.accv.es/legislacion_c.htm" - Source: "00000000-00002484.00000003.189784.17384000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/0s)kmue" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crl0]h8/q" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\*0a" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0d-trust" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0^ub96" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=u%2f33p0e%2ffldeotevgnsv2gq70%2fxnpe3komimpthj7sxnh2qnt27ur1zh0t%2bmdrwmlsognjnqjw1cw%2fbwhznqb8g6iwyadcbysqxjlscqx6fkda3rr5rd0%2ft5w7ny7nzlha%3d%3d" - Source: "00000000-00002484.00000003.189784.17800000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/unitrust1uca" - Source: "00000000-00002484.00000003.189784.17843000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\0p1$0" - Source: "00000000-00002484.00000003.189784.17843000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cpsfuge,9xmiw)!h" - Source: "00000000-00002484.00000003.189784.178B0000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crllmemzldap://directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c=http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl8http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist8http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" - Source: "00000000-00002484.00000003.189784.178B0000.00000004.mdmp") Found URL "http://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl06wb/u%3" - Source: "00000000-00002484.00000003.189784.178B0000.00000004.mdmp") Found URL "http://www.accv.eslocal" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlizenpe" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://repository.swisssign.com/" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl05zjd^nw)ocitvgkjuqgzxeeud4h" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.es0cghdlm" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esuuuuhmen" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/starfield" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crl" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://crl.godaddy.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0l1.0,%atos" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0]0[uhttp://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0l1.0,%atos" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crlkaydjm'u%'^" - Source: "00000000-00002484.00000003.189784.178B8000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl0el4bt\c[..a$z]in" - Source: "00000000-00002484.00000003.189784.17946000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl0*'a+" - Source: "00000000-00002484.00000003.189784.17946000.00000004.mdmp") Found URL "http://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl06wb/u%3" - Source: "00000000-00002484.00000003.189784.1794C000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0+l\ynvqxmnbt-44\_wfxdsr>qm[pv" - Source: "00000000-00002484.00000003.189784.1794C000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0lvuau+-6?e'qpztnq1" - Source: "00000000-00002484.00000003.189784.1794C000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00002484.00000003.189784.1794C000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl%seees1b0@9autoridad" - Source: "00000000-00002484.00000003.189784.C9054000.00000004.mdmp") Found URL "http://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00002484.00000003.189784.C9054000.00000004.mdmp") Found URL "https://github.com/oven-sh/bun/blob/main/src/runtime/api/ffi.h//" - Source: "00000000-00002484.00000003.189784.C90A2000.00000004.mdmp") Found URL "https://github.com/oven-sh/webkit/blob/main/source/" - Source: "00000000-00002484.00000003.189784.C90A2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0u" - Source: "00000000-00002484.00000003.189784.C90ED000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmnonic" - Source: "00000000-00002484.00000003.189784.C90ED000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0+0)" - Source: "00000000-00002484.00000003.189784.C90ED000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlnykiadk" - Source: "00000000-00002484.00000003.189784.C90ED000.00000004.mdmp") Found URL "https://amm-frosty.lol170zlhjdmvxd3dzbmhpwjbasfdny0wc98zlhjdmvxd3dzbmhpwjbasfdny0w298zlhjdmvxd3dzbmhpwjbasfdny0w300zlhjdmvxd3dzbmhpwjbasfdny0wl50zlhjdmvxd3dzbmhpwjbasfdny0w+" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://cold-signal.pw" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lol%77%72%69%74%65%49%6e%74%33%32%4c%45fallback_token_ok%46%77%39%62%55%41%77%54%51%67%3d%3dyhe4dhcgdgggkm9jnxlqnq==%38%33%63%30%63%65%63%34%33%62%36%65ywujymxjomb3ys1kbw83d2fhqkjlsvg=ywujymxjomb3ys1kbw83d2fhqkjlsvg=%38%63%36%62%34%33%34%64%32%30%62%0d%0a%55%73%65%72%2d%41%67%65%6e%74%3a%20%4d%45%4d%4c%4f%41%44%5f%4c%4f%47%20%6e%3d170wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq98wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%52%45%50%4f%52%54%5f%53%45%43%52%45%54298wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq300wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq50wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq230wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%45%58%45%43%5f%54%48%52%4f%57%3d189wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%73%65%74%41%75%74%68%54%61%67312wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq+251wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq196wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq125wlgwdklycdhzv0zwym5jmk1isnjhblppwxdvpq%46%41%4c%4c%42%41%43%4b%5f%45%52%52%20https://bears-speed.lol%38%33%63%30%63%65%63%34%33%62%36%65%2e%2f%72%65%67%69%73%74%72%79%37%65%63%68%61%72%43%6f%64%65%41%74fallback_reserve_ok" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cc%30%30%61%38%38%61%30%37%64%66mnr1jc4jzws4pdv0dyvdfvjwewzb%77%72%69%74%65%46%69%6c%65%53%79%6e%63icmiyj00mj51njzgbq0=%2e%2f%72%65%67%69%73%74%72%79%37%65%4e%4f%5f%54%4f%4b%45%4e%5f%45%58%49%54%54%56%64%65%58%6c%64%4f%57%77%3d%3d%77%72%69%74%65%55%49%6e%74%31%36%4c%45telemetry_err" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://ip.seeip.orgt170revdullqvf9et05fig1vzhvszt0%34%33%37%33%36%39%6e%7a%79%49%79%59hv98revdullqvf9et05fig1vzhvszt0%38%31%36%36%32%44%42%4f%4d%79%63298revdullqvf9et05fig1vzhvszt0300revdullqvf9et05fig1vzhvszt0%31%31%30%33%32%32%38%4d%52%71%4e%73%47x650revdullqvf9et05fig1vzhvszt0230revdullqvf9et05fig1vzhvszt0%33%34%38%37%32%37%32%71%55%68%41%70%74189revdullqvf9et05fig1vzhvszt0312revdullqvf9et05fig1vzhvszt0%31%30%39%36%30%33%32%53%4a%77%52%59%6a;251revdullqvf9et05fig1vzhvszt0%34%32%32%39%30%35%35%56%76%6c%6a%42%49196revdullqvf9et05fig1vzhvszt0%37%36%32%37%33%30%6b%65%72%4a%73%59125revdullqvf9et05fig1vzhvszt0=ad149revdullqvf9et05fig1vzhvszt0q202revdullqvf9et05fig1vzhvszt0g180revdullqvf9et05fig1vzhvszt0%66%72%6f%6d%43%68%61%72%43%6f%64%65308revdullqvf9et05fig1vzhvszt0%63%68%61%72%43%6f%64%65%41%74253revdullqvf9et05fig1vzhvszt0u212revdullqvf9et05fig1vzhvszt0webrequestorresponsehasbodyvalue,emiterrornexttickiferrorlistenerntemiterrornexttickiferrorlistenergetisnextincomingmessagehttpsr" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://nightly-sun.ccjgn11revdullqvf9et05fig1vzhvszt0f7c66bb9887a6ccac7f8b16e104f3d8f10revdullqvf9et05fig1vzhvszt0bgadafvuuvjwbg8cuadubf5xbwdvbvec29revdullqvf9et05fig1vzhvszt0%37%35%62%66%62%61%66%62%65%3153revdullqvf9et05fig1vzhvszt0%30%32%36%31%63%63%64%63%39%33%33%32119revdullqvf9et05fig1vzhvszt0zab275revdullqvf9et05fig1vzhvszt0%2f%70%6b%67%2f%6e%6f%64%65%2f%62%6c%6f%62l110revdullqvf9et05fig1vzhvszt0tflcrbdacg1ghevaavvbqa==%63%38%32%34%38%33%64%64%32%33%36%35s60revdullqvf9et05fig1vzhvszt0s!2103revdullqvf9et05fig1vzhvszt0132revdullqvf9et05fig1vzhvszt0u1ejuwubaaygw1qhxqseal4eal8fugqi136revdullqvf9et05fig1vzhvszt0324revdullqvf9et05fig1vzhvszt06160revdullqvf9et05fig1vzhvszt0https://cold-signal.pw326revdullqvf9et05fig1vzhvszt0https://iron-pulse.cc182revdullqvf9et05fig1vzhvszt0https://amm-frosty.lol166revdullqvf9et05fig1vzhvszt0https://bears-speed.loli4333revdullqvf9et05fig1vzhvszt0fxivewwwynhiz0zhwgcl23revdullqvf9et05fig1vzhvszt0e310revdullqvf9et05fig1vzhvszt0%54%56%64%65%58%6c%64%4f%57%77%3d%3ddrelbte9hx0vsuiasumxoewzsndauke9pdqpvc2vylufnzw50oiay2hhcknvzgvbdavfzkzvhsze9xdz09dg9ju09tdhjpbmcmta5njazmlnkd1jzagu2vszwn0t2jqzwn0yxbwzw5krmlszvn5bmmntc1nmyzytfmna0tvcmfuzg9tqnl0zxmahr0chm6ly9pcm9ulxb1bhnllmnj%72%65%73%74%6f%72%65%45%50restoreepno_payload_exitno_payload_exit%73%75%62%73%74%72%69%6e%67substring%62%61%73%65%36%34base64%72%65%6a%65%63%74reject00a88a07df%65%62%32%66%31%66eb2f1f%63%62%32%61%37%33%31%30cb2a7310tflcrbdacg1ghevaavvbqa==tflcrbdacg1ghevatflcrbdacg1ghevaavvbqa==https://ident.mehttps://ident.me%45%4e%44%50%4f%49%4e%54%53endpoints%41%56%56%42%42%41%3d%3davvbba==createhash%44%65%6c%65%74%65%44%43deletedc%63%61%74%63%68catchc64c%33%41%58%75%48%50%473axuhpgstatus_resp" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lol%73%63%6f%72%65score%6e%75%6d%62%65%72number%73%75%62%73%74%72%69%6e%67substring%77%72%69%74%65writeb3ed%70%61%72%73%65parsefallback_status_err" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://cold-signal.pwhttps://cold-sighttps://cold-signal.pw]98n2q5ytmxmwe1odjl%34%62%38%64%66%64%62%324b8dfdb2c-" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lol312q09nuefux0zbsuwgc2nvcmu9writeint32le251q09nuefux0zbsuwgc2nvcmu9%39%38%37%36%35%2e%74%78%7498765.txt196q09nuefux0zbsuwgc2nvcmu9%33%35%77%5a%67%77%70%7435wzgwpt125q09nuefux0zbsuwgc2nvcmu9fallback_token_okfallback_token_ofallback_token_okfw9buawtqg==yhe4dhcgdgggkm9jnxlqnq==yhe4dhcgdgggkm9jyhe4dhcgdgggkm9jnxlqnq==%73%65%61%72%63%68search83c0cec43b6e%46%42%55%44%41%41%3d%3dfbudaa==ywujymxjomb3ys1k8c6b434d20buser-agent:" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://bears-speed.lolhttps://bears-sphttps://bears-speed.lol%4d%42%20%7c%20mb" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cchttps://nightly-https://nightly-sun.cc5298y3jlyxrlq2lwagvyaxy%70%72%6f%74%6f%63%6f%6cprotocoln300y3jlyxrlq2lwagvyaxy00a88a07df50y3jlyxrlq2lwagvyaxy%36%62%66%63%61%656bfcaeg230y3jlyxrlq2lwagvyaxymnr1jc4jzws4pdv0dyvdfvjwewzbmnr1jc4jzws4pdv0pe189y3jlyxrlq2lwagvyaxy%43%4f%4e%4e%45%43%54%20connect" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://ip.seeip.orghttps://ip.seeiphttps://ip.seeip.org125s1hzc0xhchljalvuy0y0pq%41%55%46%42%58%52%45%3daufbxre=437369nzyiyy81662dbomyc%33%41%58%75%48%50%473axuhpg1103228mrqnsg1103228mrqnsg%31%35%45%67%48%78%67%7415eghxgt3487272quhapt3487272quhapt%33%35%77%5a%67%77%70%7435wzgwpt1096032sjwryj1096032sjwryj4229055vvljbi4229055vvljbi762730kerjsy%32%35%33%79%71%43%68%6c%61253yqchla%6c%65%6e%67%74%68lengthpushfromcharcodecharcodeatjoinmu3" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp") Found URL "https://nightly-sun.cchttps://nightly-https://nightly-sun.ccf7c66bb9887a6ccabgadafvuuvjwbg8c75bfbafbe10261ccdc9332/pkg/feed/health/pkg/feed/health/pkg/node/blob/pkg/node/blobtflcrbdacg1ghevaavvbqa==tflcrbdacg1ghevatflcrbdacg1ghevaavvbqa==4revdullqvf9et05fig1vzhvszt0c82483dd2365lybd/app/init/submit%75%6e%64%65%66%69%6e%65%64undefinedu1ejuwubaaygw1qh%30%33%38%30%61%39%330380a93%73%70%6c%6c%63%72%61%73%68spllcrashhttps://cold-signal.pwhttps://cold-sighttps://cold-signal.pwhttps://iron-pulse.cchttps://iron-pulhttps://iron-pulse.cchttps://amm-frosty.lolhttps://amm-froshttps://amm-frosty.lolhttps://bears-speed.lolhttps://bears-sphttps://bears-speed.lolfxivewwwynhiz0zhwgclfxivewwwynhiz0zhfxivewwwynhiz0zhwgcl%30%33%66%37%33%63%36%3903f73c69" - Source: "00000000-00002484.00000003.189784.D4408000.00000004.mdmp")53:T6e0,GET /raw HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Connection: keep-alive Host: myexternalip.com GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Connection: keep-alive Host: nightly-sun.cc GET /s/spllcrash HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Connection: keep-alive Host: t.me GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol GET /pkg/feed/health?v=0261ccdc9332 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Connection: keep-alive Host: amm-frosty.lol 54:T6ab,Found registry query API: "RegOpenKeyExA" in "00000000-00002484.00000000.185345.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.17340000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.17340000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002484.00000000.185345.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.17340000.00000004.mdmp, 00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.17340000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.17340000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00002484.00000000.185345.D45DC000.00000004.mdmp, 00000000-00002484.00000001.187267.C90A5000.00000004.mdmp, 00000000-00002484.00000001.187267.D45C4000.00000004.mdmp, 00000000-00002484.00000002.189188.D45C4000.00000004.mdmp, 00000000-00002484.00000003.189784.C90A5000.00000004.mdmp, 00000000-00002484.00000003.189784.D45C4000.00000004.mdmp" Found registry query API: "IRegQueryValueExA" in "00000000-00002484.00000001.187267.D4408000.00000004.mdmp, 00000000-00002484.00000002.189188.D4408000.00000004.mdmp, 00000000-00002484.00000003.189784.D4408000.00000004.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00002484.00000002.189188.0EC66000.00000002.mdmp, 00000000-00002484.00000002.189188.D5800000.00000004.mdmp"55:T777,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002484.00000000.185345.178EE000.00000004.mdmp 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall." (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall null or undefined value" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallined value" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstallue" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002484.00000001.187267.D4408000.00000004.mdmp 00000000-00002484.00000002.189188.D4408000.00000004.mdmp 00000000-00002484.00000003.189784.D4408000.00000004.mdmp56:T1216,"46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "")57:T832,"" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "

About

Blog

Apps

Platform