24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 46e7d0e507f9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 46e7d0e507f9…. Malware family: Zusy.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa"],"about":{"@type":"SoftwareApplication","name":"e36a28d0d74157349ac6dd62b79d979e.exe","applicationCategory":["peexe","executable"],"identifier":"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":15,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6eb,Found string - \\.\SICE; Source: "00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\SIWVID; Source: "00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\NTICE; Source: "00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\oreans32; Source: "00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\Global\oreans32; Source: "00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\Global\oreansx64; Source: "00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\Oreans.vxd; Source: "00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\SICE; Source: "00000000-00001924.00000000.78771.00AF2000.00000040.mdmp, 00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\SIWVID; Source: "00000000-00001924.00000000.78771.00AF2000.00000040.mdmp, 00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\NTICE; Source: "00000000-00001924.00000000.78771.00AF2000.00000040.mdmp, 00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\oreans32; Source: "00000000-00001924.00000000.78771.00AF2000.00000040.mdmp, 00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\Global\oreans32; Source: "00000000-00001924.00000000.78771.00AF2000.00000040.mdmp, 00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\Global\oreansx64; Source: "00000000-00001924.00000000.78771.00AF2000.00000040.mdmp, 00000000-00001924.00000001.79878.00AF2000.00000040.mdmp") Found string - \\.\Oreans.vxd; Source: "00000000-00001924.00000000.78771.00AF2000.00000040.mdmp, 00000000-00001924.00000001.79878.00AF2000.00000040.mdmp")26:Te03,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AD7E1C28B064EF8F6003402014C3D0E3370EB58A") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AD7E1C28B064EF8F6003402014C3D0E3370EB58A") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B1BC968BD4F49D622AA89A81F2150152A41D829C") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B1BC968BD4F49D622AA89A81F2150152A41D829C") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B31EB1B740E36C8402DADC37D44DF5D4674952F9") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B31EB1B740E36C8402DADC37D44DF5D4674952F9") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CA3AFBCF1240364B44B216208880483919937CF7") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CA3AFBCF1240364B44B216208880483919937CF7") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D1EB23A46D17D68FD92564C2F1F1601764D8E349") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D1EB23A46D17D68FD92564C2F1F1601764D8E349") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A")27:T3d76,Assembly shows XOR instruction xor dword ptr [esp] 7BD24DA1h in Stream UID: 00000000-00001924-46241-3381-00AF5E46 Assembly shows XOR instruction xor dword ptr [esp+04h] eax in Stream UID: 00000000-00001924-46241-3381-00AF5E46 Assembly shows XOR instruction xor eax dword ptr [esp] in Stream UID: 00000000-00001924-46241-3381-00AF5E46 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 00000000-00001924-46241-3381-00AF5E46 Assembly shows XOR instruction xor ebx dword ptr [esp] in Stream UID: 00000000-00001924-46241-3381-00AF5E46 Assembly shows XOR instruction xor dword ptr [esp] ebx in Stream UID: 00000000-00001924-46241-3381-00AF5E46 Assembly shows XOR instruction xor eax 0Ch in Stream UID: 00000000-00001924-49625-415-00949860 Assembly shows XOR instruction xor al C0h in Stream UID: 00000000-00001924-49625-415-00949860 Assembly shows XOR instruction xor byte ptr [ebp-6BDFFF6Ch] dl in Stream UID: 00000000-00001924-49625-415-00949860 Assembly shows XOR instruction xor al byte ptr [esp+edx+20h] in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor edi ecx in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor ecx esi in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor esi ebp in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor edi ebp in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor edi esi in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00001924-49625-447-00948C10 Assembly shows XOR instruction xor bl byte ptr [esp+ecx-49h] in Stream UID: 00000000-00001924-49625-534-009443D0 Assembly shows XOR instruction xor bl 68h in Stream UID: 00000000-00001924-49625-534-009443D0 Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00001924-49625-534-009443D0 Assembly shows XOR instruction xor edx 02h in Stream UID: 00000000-00001924-49625-534-009443D0 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00001924-49625-534-009443D0 Assembly shows XOR instruction xor edi ecx in Stream UID: 00000000-00001924-49625-547-00943BE0 Assembly shows XOR instruction xor edi 000000E6h in Stream UID: 00000000-00001924-49625-547-00943BE0 Assembly shows XOR instruction xor ecx FFFF0000h in Stream UID: 00000000-00001924-49625-548-00943AE0 Assembly shows XOR instruction xor edx BFFFFFFFh in Stream UID: 00000000-00001924-49625-548-00943AE0 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00001924-49625-835-00938130 Assembly shows XOR instruction xor dl DCh in Stream UID: 00000000-00001924-49625-835-00938130 Assembly shows XOR instruction xor dl byte ptr [esp+ecx+28h] in Stream UID: 00000000-00001924-49625-837-00938060 Assembly shows XOR instruction xor ecx 54D6FB47h in Stream UID: 00000000-00001924-49625-841-00937BE0 Assembly shows XOR instruction xor dl byte ptr [esp+edi+0Dh] in Stream UID: 00000000-00001924-49625-841-00937BE0 Assembly shows XOR instruction xor dl 8Bh in Stream UID: 00000000-00001924-49625-841-00937BE0 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00001924-49625-842-00937B70 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00001924-49625-842-00937B70 Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edi C702A80Eh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ecx 000000F1h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 38FD57F1h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 000000A6h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor esi FFFFFFFFh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ebp 59h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ecx 2Ch in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor cl dl in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 38h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 0000008Ah in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor esi E1D126E9h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx esi in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor esi 000000FEh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 000000EEh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor eax F208E0D6h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor esi 000000FDh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor esi 000000F6h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 4B0B6875h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor esi 4B0B6875h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ecx B4F4978Ah in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ebx 4B0B6875h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 14h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 08h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ecx 6Eh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx D7F523E0h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edx 11h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ecx 11h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor edi 01h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ecx CB200678h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor dl byte ptr [esp+58h] in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ebx D7F523E0h in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor ebp FFFFFFFFh in Stream UID: 00000000-00001924-49625-931-00932750 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor ebx 000000EBh in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor edi 14h in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor eax FFFFFFFEh in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor ecx esi in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor cl dl in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor edi B8E1E51Eh in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor ecx 1Eh in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor bl dh in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor cl D8h in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor ecx ebx in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor edx 2Ch in Stream UID: 00000000-00001924-49625-944-0093141B Assembly shows XOR instruction xor ecx dword ptr [00965760h] in Stream UID: 00000000-00001924-49625-1035-0092BDD0 Assembly shows XOR instruction xor edi esi in Stream UID: 00000000-00001924-49625-1037-0092BCE0 Assembly shows XOR instruction xor ecx dword ptr [009656F8h] in Stream UID: 00000000-00001924-49625-1037-0092BCE0 Assembly shows XOR instruction xor al byte ptr [esi+edi+49h] in Stream UID: 00000000-00001924-49625-1044-0092B5A0 Assembly shows XOR instruction xor al 03h in Stream UID: 00000000-00001924-49625-1044-0092B5A0 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00001924-49625-1044-0092B5A0 Assembly shows XOR instruction xor byte ptr [esi+ecx+60h] cl in Stream UID: 00000000-00001924-49625-1224-0092B3E3 Assembly shows XOR instruction xor ecx 02h in Stream UID: 00000000-00001924-49625-1224-0092B3E3 Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00001924-49625-1224-0092B3E3 Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx 16h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edi 7439CA1Eh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor esi A4F62C6Ch in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ebx A4F62C6Ch in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edi 5B09D393h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor eax 6Ch in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edi 00000093h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx 00000093h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor esi FFFFFFFFh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx 000000F0h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx 4Ah in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor al FFh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx 28h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edi 02h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor esi edx in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor esi 02h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ecx 000000A3h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx 5Eh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edi esi in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ebx 000000FEh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx 54h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx 1Ah in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ebx 0BD8A69Eh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ebx 41h in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ecx FFFFFFFEh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor ebx edx in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00001924-49625-1324-0092F6CF Assembly shows XOR instruction xor bl dl in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor esi ecx in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor edx 000000A4h in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor ecx 000000A4h in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor esi FFFFFFFFh in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor edx 000000FCh in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor eax FFFFFFFEh in Stream UID: 00000000-00001924-49625-1335-00931DF8 Assembly shows XOR instruction xor dl byte ptr [esi] in Stream UID: 00000000-00001924-49625-1552-00949145 Assembly shows XOR instruction xor dl 1Ah in Stream UID: 00000000-00001924-49625-1552-00949145 Assembly shows XOR instruction xor edx dword ptr [009658A0h] in Stream UID: 00000000-00001924-49625-1998-0092CB1C Assembly shows XOR instruction xor eax dword ptr [00965704h] in Stream UID: 00000000-00001924-49625-2003-0092BD6528:Tfc5,Found XOR loop in file "sample.bin" at offset 45320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 99312; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 138796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 454564; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 706949; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1322871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1323169; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2076753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2355276; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2357628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2494719; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2709406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2758187; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2769030; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2878988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 56972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 62267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 63179; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 69903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 93747; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 96200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 149068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711492; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1103338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1659780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1691524; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1722666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1804471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2105914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2149829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2149837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2195261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2265509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2300254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2315821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2427403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2603199; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2746580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2749944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2777721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 201; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10322; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 52505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 291818; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 388825; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1370562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1955046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1965192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2003867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2054315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2272551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2323126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2407057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2723720; code bytes = 803029:T12ce,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000987744fc2a0095e19477e5342a00feffffff24fb2a00bd6bb1750200000082289877a0fb2a00f799b175340000c081ec0000000000008591af00180000000000000078fb2a00400000000000000064fb2a00000000000000000000000000000000000c0000000200000001012a00c2ebcd750000000000004300508f4700bc6632fe81ec000039001a002d000000a82d43000000000000000000988e470001000000488f4700c0fb2a0000299877fffffffff4fb2a00087f9700b459d47514506aeed8fb2a00086fd475086fc89300000000a1dfcd7500000000a1dfcd7514506aee (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e000b96e11000000800f170000001700a011170095e1947705342a00feffffff000000003300000010f32a001100000000001700800f170010f32a00145c9877435c987785df9877020000000c0217000000170050011700000200000000000050011700b4f42a00a4019a776cf22a003300000000f89877500117001413b96ee825170000000000440000003ff00000110000000000000000000000e81e4300a8f22a000000000044000044c4001700400100417665437269746963000000007f0000006e00006940010041e825170001000000000000000200000008000000 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000001800000000000000b8f42a000000000044fc2a0092e0806e2cf7b290feffffff70fb2a004c9c806e0d0c000090fb2a005f9c806e000000000000000000000000000000000000000000000000bcf819fec4fb2a00ee2d7f6e0d0c000090fb2a00d718b000d718b000fe2d7f6ef8fb2a0001000000000000000000b96e000000009c5397777618b175000000009f18b175216132fe00000000087f9700b459d47514506aeed8fb2a00086fd475086fc893000000000000000000000000db0f98007e32b100 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f00000003e00c97514506aee90fb2a00d879b600d5fdb100f879b6003e00c97514506aeea8fb2a00d879b600c1f7c893e4fb2a00d879b6003e00c9750002000000020000db0f98007231b700 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000660030003900390063003200620062003600610036003200310035003600360061003300390038006400350066003800620038003200650065003900660061002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b987755caab73d8ebb776ac0143000000430000000000000000001d006b003e0d0609000000000000000000000000000000001e0066003e0d06090000000000000000c07343000000000020000000000000000000000018945000b0704300d0714300b8754b0478754300000000003ce6190400000000bce71904 (UID: 00000000-00001924)2a:Td34,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2b:T865,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")2c:T1b26,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001924)2d:T5f11,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptGetObjectUrl (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpSetStatusCallback (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SetupIterateCabinetW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter DevRtlGetThreadLogToken (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00001924) "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00001924)2e:T441,"GET /SectigoPublicServerAuthenticationRootR46.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.sectigo.com" Response ==> HTTP/1.1 200 OK Date: Sun 23 Aug 2026 20:15:43 GMT Content-Type: application/pkcs7-mime Content-Length: 4563 Connection: keep-alive Server: cloudflare set-cookie: __cf_bm=CmDiC9AskcRsCCZ8d3j5sTZClPdTeW253lMHK6tZo0s-1787516143.9459386-1.0.1.1-nrnOMXCEitPLIdUUU9NPqJNeIw1R_HDfTZhO3CA0pccWLU04vpPOCCtW1QPqCua.pSL16iQXmSNLflwLPH5s2MdLG383s_l.Bch3yEgzBXFrlPk.lo3RHS8P1FZJjmC3; HttpOnly; Path=/; Domain=crt.sectigo.com; Expires=Sun 23 Aug 2026 20:45:43 GMT Last-Modified: Tue 09 Sep 2025 15:20:16 GMT etag: "adee2369215597e6aed4825fbd8bf81e62b61071" cache-control: max-age=86400 s-maxage=14400 public no-transform must-revalidate X-CCACDN-Proxy-ID: scdpinlb1 X-Frame-Options: SAMEORIGIN Age: 4986 Accept-Ranges: bytes cf-cache-status: HIT CF-RAY: a2fcca7bac05ebe3-SJC with response body ==>30C28211C38F06092AC28648C286C3B70D010702C2A0C28211C38030C28211C2BC0201013100300B06092AC28648C286C3B70D010701C2A0C28211C2A430C282.......2f:T19fa,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6bda0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "NTDLL.DLL" at base 77930000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "WINMM.DLL" at base 6eb90000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "NTDLL" at base 77930000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "KERNEL32.DLL" at base 75c90000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "SHELL32.DLL" at base 75e70000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "USER32.DLL" at base 77ab0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "GDI32.DLL" at base 76d00000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "OLE32.DLL" at base 77420000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "OLEAUT32.DLL" at base 76c40000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "CRYPT32.DLL" at base 759e0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "ADVAPI32.DLL" at base 76b90000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "WS2_32.DLL" at base 75d70000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "WINHTTP.DLL" at base 717a0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "SHLWAPI.DLL" at base 75b70000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "SSPICLI.DLL" at base 756c0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "CRYPTSP.DLL" at base 75240000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "RPCRT4.DLL" at base 75be0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "CREDSSP.DLL" at base 74ed0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75200000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "WSHTCPIP" at base 74d60000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "WSHIP6.DLL" at base 751f0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 72060000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "DNSAPI.DLL" at base 750c0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74d60000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 751f0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "IPHLPAPI.DLL" at base 73b90000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "RASADHLP.DLL" at base 71ed0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73b00000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 75040000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "SECUR32.DLL" at base 75570000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "NCRYPT.DLL" at base 75370000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74f10000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "USERENV.DLL" at base 758f0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76ce0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "GPAPI.DLL" at base 74e10000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76ce0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76ce0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74fd0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "CRYPTBASE.DLL" at base 75730000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71800000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "CRYPTNET.DLL" at base 71800000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "PROFAPI.DLL" at base 75850000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "SENSAPI.DLL" at base 73880000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "DHCPCSVC6.DLL" at base 73aa0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "DHCPCSVC.DLL" at base 73a20000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "NSI.DLL" at base 77aa0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "CFGMGR32.DLL" at base 759b0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76ce0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75c90000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "SETUPAPI.DLL" at base 76e40000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "CABINET.DLL" at base 70f00000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "DEVRTL.DLL" at base 74fb0000 "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76ce000030:T417,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa" file has an entrypoint instructions - "jmp 0x70500a,divps xmm5, xmmword ptr [0],add cl, ch,add byte ptr [eax], ah,add byte ptr [eax], al,add byte ptr [edx + ecx], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add al, 0xa,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,push es,add byte ptr [eax], 0,add byte ptr [eax], al,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add al, 0xa,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,xor byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"31:T503,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for class "OLLYDBG" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for class "GBDYLLO" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for class "pediy06" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for class "FilemonClass" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for class "PROCMON_WINDOW_CLASS" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for class "RegmonClass" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for class "18467-41" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" searching for class "Regmonclass"32:T51a,"TarE292.tmp" has type "DER Encoded PKCS#7 Signed Data"- Location: [%TEMP%\TarE292.tmp]- [targetUID: 00000000-00001924] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 80043 bytes 1 file at 0x2c last modified Jun 18 2026 00:32:04 +A "authroot.stl" number 1 7 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001924] "3FFA110365478402FA10A3985CC7CA2D" has type "DER Encoded PKCS#7 Signed Data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\3FFA110365478402FA10A3985CC7CA2D]- [targetUID: 00000000-00001924] "3FFA110365478402FA10A3985CC7CA2D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\3FFA110365478402FA10A3985CC7CA2D]- [targetUID: 00000000-00001924] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001924] "CabE291.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 80043 bytes 1 file at 0x2c last modified Jun 18 2026 00:32:04 +A "authroot.stl" number 1 7 datablocks 0x1 compression"- Location: [%TEMP%\CabE291.tmp]- [targetUID: 00000000-00001924]33:T7a7,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E972-E325-11CE-BFC1-08002BE10318}"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-31-67"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "")34:T10bd,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")35:Tbe8,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\FLTLIB.DLL" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\MSVCP140.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\VCRUNTIME140.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\ucrtbase.DLL" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll"36:Tcf7,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\FLTLIB.DLL" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\MSVCP140.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\ucrtbase.DLL" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"37:T517,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\3ffa110365478402fa10a3985cc7ca2d" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\3ffa110365478402fa10a3985cc7ca2d" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" writes file "c:\users\%osuser%\appdata\local\temp\cabe291.tmp" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" writes file "c:\users\%osuser%\appdata\local\temp\tare292.tmp" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" writes file "%temp%\tare292.tmp" "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506"38:Tbb6,"46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4b3f70" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4afbb8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4bedf0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "44be008" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "44d46b0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4f20b50" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4beee0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "44c13b0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "44c13b0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "46e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exe" called "WinHttpSendRequest" with parameters {"hRequest": "44c13b0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"}39:T520,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001924-00000C2C-241301685") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001924-00000C2C-241301980") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001924-00000C2C-245641786") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001924-00000C2C-245642653") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00001924-00000C2C-245642776") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001924-00000C2C-245642776") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001924-00000C2C-245642776") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00001924-00000C2C-247201554") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001924-00000C2C-247201554") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00001924-00000C2C-247230618") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001924-00000C2C-247231025")3a:T20dc,Heuristic match: "gb#].gg" Heuristic match: "fgx.gg" Heuristic match: "7,.gg" Heuristic match: "',.gg" Heuristic match: "w,.gg" Heuristic match: "/,.gg" Heuristic match: "gb#[.gg" Heuristic match: "_,.gg" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl05" Heuristic match: "crt.sectigo.com" Heuristic match: "get /sectigopublicserverauthenticationrootr46.p7c http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: crt.sectigo.com" Pattern match: "www.sysinternals.com" Heuristic match: "ctldl.windowsupdate.com" Heuristic match: "steamcommunity.com" Pattern match: "https://mindhandru.buzz/api" Heuristic match: "`..ck" Pattern match: "https://scentniej.buzz/api" Heuristic match: "tldl.windowsupdate.com" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" Heuristic match: "teamcommunity.com" Pattern match: "cashfuzysao.buzz/api" Pattern match: "http://crt.sectigo.com/zerosslrsadvsslca2.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "crl.sectigo.com/sectigopublicserverauthenticationrootr46.crl0" Pattern match: "crt.sectigo.com/sectigopublicserverauthenticationrootr46.p7c0#" Pattern match: "inherineau.buzz/api" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://g.symcd.com0" Pattern match: "http://www.geotrust.com/resources/cps06" Pattern match: "http://g.symcb.com/geotrustpca-g3.crl0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://isrg.trustid.ocsp.identrust.com0" Pattern match: "http://apps.identrust.com/roots/dstrootcax3.p7c0" Pattern match: "http://cps.root-x1.letsencrypt.org0" Pattern match: "http://crl.identrust.com/dstrootcax3crl.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.usertrust.com1" Pattern match: "www.google.com0" Pattern match: "https://secure.comodo.com/cps0" Pattern match: "crl.comodoca.com/utn-userfirst-hardware.crl06" Pattern match: "crl.comodo.net/utn-userfirst-hardware.crl0q" Pattern match: "http://crt.comodoca.com/utnaddtrustserverca.crt0$" Pattern match: "http://ocsp.comodoca.com0%" Pattern match: "www.google.com" Pattern match: "http://www.public-trust.com/cps/omniroot.html0" Pattern match: "www.public-trust.com/cgi-bin/crl/2018/cdp.crl0" Pattern match: "http://ocsp.comodoca.com05" Heuristic match: "addons.mozilla.org" Pattern match: "www.addons.mozilla.org0" Pattern match: "2www.entrust.net/cps" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://crl.entrust.net/server1.crl0" Pattern match: "http://www.diginotar.nl/cps/pkioverheid0" Pattern match: "http://crl.pkioverheid.nl/domovlatestcrl.crl0" Pattern match: "http://ocsp.comodoca.com0/" Heuristic match: "login.skype.com" Pattern match: "www.login.skype.com0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0" Heuristic match: "login.yahoo.com" Pattern match: "www.login.yahoo.com0" Pattern match: "www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com" Pattern match: "www.verisign.com/repository/verisignlogo.gif0d" Pattern match: "https://www.verisign.com/rpa0" Heuristic match: "mail.google.com" Pattern match: "www.mail.google.com0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://ocsp.entrust.net0d" Pattern match: "http://www.digicert.com.my/cps.htm02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Pattern match: "http://ocsp.comodoca.com0-" Heuristic match: "login.live.com" Pattern match: "www.login.live.com0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Heuristic match: "0k.ug" Heuristic match: "4k.uz" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Heuristic match: "vo.uy" Pattern match: "www.digicert.com1+0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Pattern match: "steamcommunity.com/profiles/76561199724331900" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.usertrust.com/utn-userfirst-networkapplications.crl0" Pattern match: "http://www.usertrust.com1604" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e.crt" Heuristic match: "ft.map.fastly.net" Heuristic match: "wu-b-net.trafficmanager.net" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en" Heuristic match: "//ctldl.windowsupdate.com" Heuristic match: "crt.comodoca.com.cdn.cloudflare.net" Heuristic match: "bg.microsoft.map.fastly.net" Pattern match: "http://www.entrust.net/crl/net1.crl0+" Pattern match: "http://www.certplus.com/crl/class3p.crl0" Pattern match: "http://www.trustcenter.de/guidelines0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl04" Heuristic match: "eamcommunity.com" Pattern match: "https://screwamusresz.buzz/api" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0p" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0" Pattern match: "www.correduriapublica.org.mx/rcd/dpc0" Heuristic match: "silver-certs@saunalahti.fi" Pattern match: "http://ca.sia.it/secsrv/repository/crl.der0j" Pattern match: "http://www.certplus.com/crl/class3.crl0" Pattern match: "http://www.certplus.com/crl/class3ts.crl0" Heuristic match: "info@a-cert.at" Pattern match: "http://www.a-cert.at/certificate-policy.html0" Pattern match: "http://www.a-cert.at0e" Pattern match: "secure.a-cert.at/cgi-bin/a-cert-advanced.cgi0" Pattern match: "6www.entrust.net/ssl_cps" Heuristic match: "ntrust.net" Heuristic match: "zenpe.com" Heuristic match: "ldl.windowsupdate.com" Pattern match: "http://www.e-szigno.hu/szsz/" Heuristic match: "enpe.com" Heuristic match: "2[.ne" Heuristic match: ";.vg" Pattern match: "https://www.netlock.hu/docs/" Pattern match: "http://www.rootca.or.kr/rca/cps.html0" Pattern match: "http://www.certicamara.com/certicamaraca.crl0" Pattern match: "https://rca.e-szigno.hu/ocsp0-" Pattern match: "http://www.e-szigno.hu/rootca.crt0" Pattern match: "http://www.e-szigno.hu/szsz/0" Pattern match: "http://www.e-szigno.hu/rootca.crl" Pattern match: "ldap.e-szigno.hu/cn=microsec%20e-szigno%20root%20ca,ou=e-szigno%20ca,o=microsec%20ltd.,l=budapest,c=hu?certificaterevocationlist;binary0" Heuristic match: "info@e-szigno.hu" Pattern match: "http://www.e-trust.be/cps/qncerts" Pattern match: "http://www.ancert.com/cps0" Pattern match: "certificates.starfieldtech.com/repository/1604" Pattern match: "acrse.economia.gob.mx/last.crl0f" Pattern match: "acrse.economia.gob.mx/cps.html0"3b:T452c,Found URL "https://mindhandru.buzz/apimindhandru.buzzilemonclassrocmon_window_class?\c:\windows\s3\device\netbt_tcpip_" - Source: "00000000-00001924.00000000.78771.00430000.00000004.mdmp") Found URL "https://mindhandru.buzz/api!" - Source: "00000000-00001924.00000000.78771.00430000.00000004.mdmp") Found URL "https://scentniej.buzz/apiforvmindhandru.buzzscentniej.buzzscentniej.buzzscentniej.buzz6e7d0e507f9199983dfd42c1c79f3bef099c2bb6a621566a398d5f8b82ee9fa.exenherineau.buzznherineau.buzzmsiscanbuncrypt.dllrpc-83769a0dd1316fe39fey" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crt.sectigo.com/zerosslrsadvsslca2.crt0" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0*.scentniej.buzzscentniej.buzz0-e7gp*70sectigo" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopublicserverauthenticationrootr46.crl0x0v0ochttp://crt.sectigo.com/sectigopublicserverauthenticationrootr46.p7c0" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0@m5ayvms?.els4<@y5'cqa2;tix'7q" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0http://ocsp.sectigo.com0timrnzq" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0*.scentniej.buzzscentniej.buzz0-e7g" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0@m5ayvms?.els4<@y5" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0@m5ayvms?.els4<@y5upxju@yjupyjahsm[" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o+um/zteo7j;8kb6" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/entrust.net1;092www.entrust.net/cps" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslc/i" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,n" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0g.uy0" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;ngte" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusq.x^ygeotrust" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?6a[jh.u" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00001924.00000001.79878.00430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001924.00000001.79878.044B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001924.00000001.79878.044B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001924.00000001.79878.044B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuh,mhhsmookhnbj'v(zttxk-tyk[j73gz;" - Source: "00000000-00001924.00000001.79878.044B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-networkapplications.crl0t" - Source: "00000000-00001924.00000001.79878.044B0000.00000004.mdmp") Found URL "http://www.microsoft.com0a>'m8rvg$,)>/" - Source: "00000000-00001924.00000001.79878.044B0000.00000004.mdmp") Found URL "http://www.usertrust.com1604-utn-userfirst-client" - Source: "00000000-00001924.00000001.79878.044B0000.00000004.mdmp") Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e.crthttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e.crtft.map.fastly.netctldl.windowsupdate.com.delivery.microsoft.comwu-b-net.trafficmanager.netctldl.windowsupdate.comctldl.windowsupdate.com.delivery.microsoft.comry.microsoft.comce" - Source: "00000000-00001924.00000001.79878.044BF000.00000004.mdmp") Found URL "http://www.entrust.net/crl/net1.crl0+19990525160940z20190525160940z0v4.0r>m-edeutsche" - Source: "00000000-00001924.00000001.79878.044BF000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class3p.crl0zb58f2<" - Source: "00000000-00001924.00000001.79878.044BF000.00000004.mdmp") Found URL "http://www.trustcenter.de/guidelines0v+i5theno>6mu" - Source: "00000000-00001924.00000001.79878.044BF000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl05)0'0%http://ocsp.usertrust.com0+" - Source: "00000000-00001924.00000001.79878.044BF000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0zkf^wlty9q2/88oft.ted1pectibf/u\*a*yf!m6p8m0y0" - Source: "00000000-00001924.00000001.79878.0453E000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00001924.00000001.79878.0453E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00001924.00000001.79878.0453E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00001924.00000001.79878.0453E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00001924.00000001.79878.0453E000.00000004.mdmp") Found URL "http://ca.sia.it/secsrv/repository/crl.der0jc0a0?0503'htt" - Source: "00000000-00001924.00000001.79878.0457A000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class3.crl0?dkvcertplus1class" - Source: "00000000-00001924.00000001.79878.0457E000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class3ts.crl0;@wb&r4%deutsche" - Source: "00000000-00001924.00000001.79878.0457E000.00000004.mdmp") Found URL "http://www.a-cert.at/certificate-policy.html0;,http://www.a-cert.at/certificate-policy.html0info@a-cert.at0/info@a-cert.athttp://www.a-cert.at0e>0<0:4https://secure.a-cert.at/cgi-bin/a-cert-advanced.cgi0!/qvvs" - Source: "00000000-00001924.00000001.79878.04F10000.00000004.mdmp") Found URL "http://www.e-szigno.hu/szsz/kaitmeninio" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e.crtca" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.microsoft.com0a>'m8rvg$,)>/" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "https://www.netlock.hu/docs/" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.rootca.or.kr/rca/cps.html0(0&1$0" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.certicamara.com/certicamaraca.crl0;,http://www.certicamara.com/certicamaraca.crl0;,http://www.certicamara.com/certicamaraca.crl0_sh,/8dhe!zry@1?0=rktrust" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "https://rca.e-szigno.hu/ocsp0-!http://www.e-szigno.hu/rootca.crt0http://www.e-szigno.hu/szsz/0!http://www.e-szigno.hu/rootca.crlldap://ldap.e-szigno.hu/cn=microsec%20e-szigno%20root%20ca,ou=e-szigno%20ca,o=microsec%20ltd.,l=budapest,c=hu?certificaterevocationlist;binary0info@e-szigno.huw0u1" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.e-trust.be/cps/qncerts" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.ancert.com/cps0ancert0agencia" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.ancert.com/cps0ancert@ancert.com0id-ax" - Source: "00000000-00001924.00000001.79878.04F73000.00000004.mdmp") Found URL "http://www.ancert.com/cps0ancert@ancert.com0q