24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 80:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 67f6aa5c680b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 67f6aa5c680b…. Malware family: Malware. Threat score 100/100. 5/25 AV engines flagged this file. 16 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/67f6aa5c680b96907b75de39219afb903d747e4bb04ccb0667294f4f33722fc4","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","67f6aa5c680b96907b75de39219afb903d747e4bb04ccb0667294f4f33722fc4"],"about":{"@type":"SoftwareApplication","name":"4f19dad06ea3f38e405559a2f7a7f7a6.exe","applicationCategory":["peexe","executable"],"identifier":"67f6aa5c680b96907b75de39219afb903d747e4bb04ccb0667294f4f33722fc4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":16,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4d6,"4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "FindResourceA" with parameter "15668044" - (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "FindResourceA" with parameter "2030924" - (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "FindResourceA" with parameter "15667912" - (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "FindResourceA" with parameter "15667920" - (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "FindResourceA" with parameter "15667948" - (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "FindResourceA" with parameter "15667960" - (UID: 00000000-00004080) "oX7Ko10.exe" called "FindResourceA" with parameter "1963956" - (UID: 00000000-00003800) "oX7Ko10.exe" called "FindResourceA" with parameter "14029512" - (UID: 00000000-00003800) "oX7Ko10.exe" called "FindResourceA" with parameter "14029520" - (UID: 00000000-00003800) "oX7Ko10.exe" called "FindResourceA" with parameter "14029548" - (UID: 00000000-00003800) "oX7Ko10.exe" called "FindResourceA" with parameter "14029560" - (UID: 00000000-00003800) "oX7Ko10.exe" called "FindResourceA" with parameter "14029576" - (UID: 00000000-00003800)26:T9ef,"4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15714272'}" (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15714384'}" (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15714416'}" (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15714400'}" (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15714368'}" (UID: 00000000-00004080) "oX7Ko10.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14075984'}" (UID: 00000000-00003800) "oX7Ko10.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14076016'}" (UID: 00000000-00003800) "oX7Ko10.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14076000'}" (UID: 00000000-00003800) "oX7Ko10.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14075968'}" (UID: 00000000-00003800) "oX7Ko10.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14075920'}" (UID: 00000000-00003800) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736296'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736312'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736136'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736344'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4735992'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736328'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736008'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736152'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736360'}" (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadResource with parameter {'hModule': '3866624', 'hResInfo': '4736024'}" (UID: 00000000-00003908)27:Td9d,"oX7Ko10.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00003800) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Autofill (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Downloads (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\Amazon Downloader Logs (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\hancom (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\My Music (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\My Pictures (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\My Videos (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\Outlook Files (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Acrobat\DC\Cache (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Acrobat\DC (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AIR\logs (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AIR (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Color\Profiles (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Color (UID: 00000000-00001024) "2Kp5742.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe (UID: 00000000-00001024)28:T802,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "7Ub6jZ95.exe.513415986") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp")29:T472,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp, 00000000-00001024.00000000.66844.00600000.00000004.mdmp, 00000000-00001024.00000001.68281.00600000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp, 00000000-00001024.00000000.66844.00600000.00000004.mdmp, 00000000-00001024.00000001.68281.00600000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp")2a:Td48,"7Ub6jZ95.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Mh+JCVywvTkSrKXwYMg70bKdVoOGzXoXDqwg4B8eWpRBcPx5Nd7JXGDJ1oQPrRW3x/M=" "cchString": "68" "dwFlags": "1" "pcbBinary": "32000000"} "7Ub6jZ95.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Mh+JCVywvTkSrKXwYMg70bKdVoOGzXoXDqwg4B8eWpRBcPx5Nd7JXGDJ1oQPrRW3x/M=" "cchString": "68" "dwFlags": "1" "pbBinary": "321f89095cb0bd3912aca5f060c83bd1b29d568386cd7a170eac20e01f1e5a944170fc7935dec95c60c9d6840fad15b7c7f3" "pcbBinary": "32000000"} "7Ub6jZ95.exe" called "CryptStringToBinaryA" with parameters {"pszString": "LWodteN/Jg6ZXJhKRQbzFpGJfL+Ytmq3qGQTnzxAMf5WZxeVw18GLO9+ompxKv4csalcn7rFD5WSRGftSSUd8ydKPZXDXUdqu2a4LCRqgHO9hHafuJZKlc0cMaUcGzz0DUo9lcNfXQOTfLhqZSbTNrGrGdG6jEqVzQ5x/lAiUJVCGnHWixNBZvw//Cspa5Zz9OgW0fHbAtqKSB6VHGAR3g1KPZXBGlwso3y6ByByklvw+hedlbxKl4hEM79BbDz0DUo9" "cchString": "16984" "dwFlags": "1" "pcbBinary": "c1310000"} "7Ub6jZ95.exe" called "CryptStringToBinaryA" with parameters {"pszString": "LWodteN/Jg6ZXJhKRQbzFpGJfL+Ytmq3qGQTnzxAMf5WZxeVw18GLO9+ompxKv4csalcn7rFD5WSRGftSSUd8ydKPZXDXUdqu2a4LCRqgHO9hHafuJZKlc0cMaUcGzz0DUo9lcNfXQOTfLhqZSbTNrGrGdG6jEqVzQ5x/lAiUJVCGnHWixNBZvw//Cspa5Zz9OgW0fHbAtqKSB6VHGAR3g1KPZXBGlwso3y6ByByklvw+hedlbxKl4hEM79BbDz0DUo9" "cchString": "16984" "dwFlags": "1" "pbBinary": "2d6a1db5e37f260e995c984a4506f31691897cbf98b66ab7a864139f3c4031fe56671795c35f062cef7ea26a712afe1cb1a95c9fbac50f95924467ed49251df3274a3d95c35d476abb66b82c246a8073bd84769fb8964a95cd1c31a51c1b3cf40d4a3d95c35f5d03937cb86a6526d336b1ab19d1ba8c4a95cd0e71fe50225095421a71d68b134166fc3ffc2b296b9673f4e816d1f1db02da8a481e951c6011de0d4a3d95c11a5c2ca37cba072072925bf0fa179d95bc4a97884433bf416c3cf40d4a3d95c35f5d03937cb86a6526d336b1ab19d1ba8c4a95c60f71f65426539b420d7cd082104366f539fe242e699774f4ef1bcfffdd04d98a481e951c6011de0d4a3d95c11a5c2ca37cba072072925bf0fa179d95bc4a97884433bf416c3cf40d4a3d95c35f5d03937cb86a6526d336b1ab19d1ba8c4a95cd0379f6582a538e4a0674d68b1b4561f738fa2927629d74f4ec0ccfffd21adf8a481e951c6011de0d4a3d95c11a5c2ca37cba1e37738062b1de1dd3f4d31e95a56e33bf1c6011de504610bfc35f062eb97ce3474f26d336b1a95c9fb8940fd98a5e33bd55225f9b470e7bdf8e124d7efa32f43a2064987afce717d0fdd903dfc70276fc1e6c3cf40d4a3d95c35f062ebb39e2687f26d142e3e612f3f1d80195a56e33bf1c6011de504610bfc35f062eb97ce3474f26d336b1a95c9fb8940fd98a5e33bd5a2e5b96400175dd8e144464f237f9282b629078ffe61bdeffd90dd5c60176fc1e6c3cf40d4a3d95c35f062ebb39e2687f26d144fee715d1b8e10bdbc40167bd314a11de0d4a3d959e532b04b97cb86a6526881b9ba95c9fb8964a97884676f11e7a11dc4b027fda8b164b6ffc30fa252d769974f3e518dcf6d109d9c9147dfb53245b8e0f4610bfc35f062eb97cb86a67638934aba95efdf1d80bd9cb0133dc542158900d3d7cd98f1a522c9456b86a6526d336eca571b5b8964a9788446892366011de0d4a3d95c35d4360bb66b86823609d74f4e51adbf7d303d8c0017df456295390400b79df8a1a4e64f13df228672afe1cb1a95c9fb8964a978a0169bd066013a7421872dcc1722c2eb97cb86a657bdf1b9ba95c9fb8964acca56e33bf1c6011de0d4a3fd08d5d1c2ebb36fa2e24699078f4e015d6f6db00d5c20874fe5028529b410d7fd089124867fd7eb4474f26d336b1a95c9fb8940fcd8a5e33bd7229578a544810bfc35f062eb97ce566480cd336b1a95c9fe3bb6097884433bf1c6011dc48043f8fc35d4768fb3ffa2035648370f0ed10d4f5de07d4c40c78fa592f55934c077ed38f1c04229456b86a6526d336b1a95edae29450978a2972eb54623cf40d4a3d95c35f5b229456b86a6526d336ea84769fb8964a97884433bd592e13c40d4875db851e4865f733fb2c20699574f5ed1bdcf1dc04dac00a75f157245f9f" "pcbBinary": "c1310000"}2b:T80fc,Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAaPhwMKbMOVDzljl316wc8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAaPhwMKbMOVDzljl316wc8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAaPhwMKbMOVDzljl316wc8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAaPhwMKbMOVDzljl316wc8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAaPhwMKbMOVDzljl316wc8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 13 Dec 2023 01:34:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 13 Dec 2023 01:34:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 13 Dec 2023 01:34:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 13 Dec 2023 01:34:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 13 Dec 2023 01:34:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466133Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466133Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466133Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466133Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466133Host: soupinterestoe.fun" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466133Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466133Host: soupinterestoe.fun"2c:T590,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to cryptographic keys Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Imports Crypto related APIs Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2d:T2efa,"4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004080) "oX7Ko10.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003800) "1bn64KB8.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776a90dddc0266ffcc0499ffff04ccffff0480dddc020000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e28c0a0ae30e4dc022a9d16760000000024832b76040000000000000000000000acf5dc0200000000e79c16760200078044dedc02000000007600000094dedc02feffffff1cdedc02cf00c677d600c67741f11e75760000003b00000094dedc026f006e00f0dddc026e00740058dedc02 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776a30e3350466ffcc0499ffff04ccffff0420e335040000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776a50e2cf0266ffcc0499ffff04ccffff0440e2cf020000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776aa0e2d90266ffcc0499ffff04ccffff0490e2d9020000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776ad0e2490466ffcc0499ffff04ccffff04c0e249040000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776ad0dd2f0466ffcc0499ffff04ccffff04c0dd2f040000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776a10e32c0466ffcc0499ffff04ccffff0400e32c040000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776a70e2cd0266ffcc0499ffff04ccffff0460e2cd020000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776a40dfd70266ffcc0499ffff04ccffff0430dfd7020000776a0000000001000000 (UID: 00000000-00003908) "1bn64KB8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000776a40e23d0466ffcc0499ffff04ccffff0430e23d040000776a0000000001000000 (UID: 00000000-00003908) "2Kp5742.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000041007000700044006100740061005c004c006f00630061006c005c00540065006d0070005c004900580050003000300031002e0054004d0050005c0032004b00700035003700340032002e006500780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bc577ab83e377d8ebe775ac0160000000600000000000000000000e00b600cb010000000000000000000000000000000000000f00b100cb0100000000000000000000106f600000000000200000000000000000000000 (UID: 00000000-00001024) "2Kp5742.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bc5775f83e377020000000c0251000000510000000000000000003100bd0002000000000000000000000000000000000000003200ac000200000000000000000000005803b10100000000 (UID: 00000000-00001024) "2Kp5742.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000085ca5aa4432a266c3802210018d02100b8d521005059266c311553c8feffffffe4cf21004b65256c90cf21004ce9a27431c5246c6465256c (UID: 00000000-00001024)2e:T8ca,"1bn64KB8.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003908) "2Kp5742.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe775182b66000030fd7f9a5cc67700f0fd7f10d521004430fd7f00000000400000003f000000210000000030fd7f04d52100c15cc6776082cd77210000000030fd7f9a5cc67700f0fd7f28d521005789c5778083cd771317d675d8ebe775 (UID: 00000000-00001024) "2Kp5742.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000200000000000000880000000000000038d52100459d3a7600005100000000008000000002000000000022009c1d06744cd521006c22067480000000d3220674dcf0067468d52100741d0674dcf006740000000098d6210000000000 (UID: 00000000-00001024) "2Kp5742.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe775b0df66000030fd7f9a5cc67700f0fd7fe8b421004430fd7f00000000400000003f000000270000000030fd7fdcb42100c15cc6776082cd77270000000030fd7f9a5cc67700f0fd7f00b521005789c5778083cd771317d675d8ebe775 (UID: 00000000-00001024) "2Kp5742.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000168726000d80100003ccad802106f600084cdd80295e1c177eb4b0700feffffffff2bc5779a2ac57738000000400000008ccbd802006c60006ccad802c88cc50184cdd80295e1c177eb4b07000300000000000000200200001800000014cbd80265b04700000060000000000018020000 (UID: 00000000-00001024) "7Ub6jZ95.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000100000000000000000035770000000010e412000000000000000000000000001c5cc4774379d575ffffffff0c0000004c62c4771f79d575ffffffff0c00000004e4120004000000000400000100000018e41200210e260000000000 (UID: 00000000-00001788)2f:T453,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "7Ub6jZ95.exe.513415986") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp")30:T4b6,"4f19dad06ea3f38e405559a2f7a7f7a6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4f19dad06ea3f38e405559a2f7a7f7a6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "oX7Ko10.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "oX7Ko10.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1bn64KB8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1bn64KB8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7Ub6jZ95.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")31:T917,"2Kp5742.exe" queries volume information of "C:\" at 00000000-00001024-0000010C-2681918 "2Kp5742.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\FANBooster131\FANBooster131.exe" at 00000000-00001024-0000010C-2817454 "2Kp5742.exe" queries volume information of "C:\" at 00000000-00001024-0000010C-8116510 "2Kp5742.exe" queries volume information of "C:\" at 00000000-00001024-0000010C-13390380 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-6726941 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-7583019 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-8583656 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-9542943 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-10516811 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-11527759 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-12447581 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-13683307 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-14708904 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-15552404 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-16272818 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-16943578 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-17616802 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-18811751 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-24606996 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-25187519 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-25684031 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-26740010 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-27272444 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-27843178 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-2856294732:T8d8,"2Kp5742.exe" queries volume information of "C:\" at 00000000-00001024-0000010C-2681918 "2Kp5742.exe" queries volume information of "C:\" at 00000000-00001024-0000010C-8116510 "2Kp5742.exe" queries volume information of "C:\" at 00000000-00001024-0000010C-13390380 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-6726941 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-7583019 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-8583656 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-9542943 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-10516811 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-11527759 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-12447581 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-13683307 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-14708904 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-15552404 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-16272818 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-16943578 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-17616802 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-18811751 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-24606996 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-25187519 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-25684031 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-26740010 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-27272444 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-27843178 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-28562947 "7Ub6jZ95.exe" queries volume information of "C:\" at 00000000-00001788-0000010C-2972569033:T9b8,"2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")34:T580,"2Kp5742.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2Kp5742.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2Kp5742.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")35:T559,"2Kp5742.exe" called "CopyFileA" to copy %TEMP%\IXP001.TMP\2Kp5742.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00001024) "2Kp5742.exe" called "CopyFileA" to copy %TEMP%\IXP001.TMP\2Kp5742.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00001024) "2Kp5742.exe" called "CopyFileA" to copy %TEMP%\IXP001.TMP\2Kp5742.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00001024) "2Kp5742.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\signons.sqlite to new location %TEMP%\posterBoxLcNYHmp8nu6rs\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00001024) "2Kp5742.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\posterBoxLcNYHmp8nu6rs\8ghN89CsjOW1places.sqlite (UID: 00000000-00001024) "2Kp5742.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\cookies.sqlite to new location %TEMP%\posterBoxLcNYHmp8nu6rs\D87fZN3R3jFecookies.sqlite (UID: 00000000-00001024) "2Kp5742.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\posterBoxLcNYHmp8nu6rs\02zdBXl47cvzplaces.sqlite (UID: 00000000-00001024)36:Tcb7,"2Kp5742.exe" called "CreateDirectoryW" with parameter %WINDIR%\System32\GroupPolicy\Machine (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryW" with parameter %WINDIR%\System32\GroupPolicy\User (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Autofill (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Downloads (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\Amazon Downloader Logs (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\hancom (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\My Music (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\My Pictures (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\My Videos (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\Outlook Files (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Acrobat\DC (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Acrobat\DC\Cache (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache (UID: 00000000-00001024) "2Kp5742.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIALcNYHmp8nu6rs\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache (UID: 00000000-00001024)37:T287c,"4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004080) "oX7Ko10.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003800) "oX7Ko10.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003800) "oX7Ko10.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003800) "oX7Ko10.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003800) "oX7Ko10.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003800) "1bn64KB8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter %TEMP%\IXP001.TMP\1bn64KB8.exe (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00003908) "1bn64KB8.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00003908) "2Kp5742.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001024) "2Kp5742.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00001024) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00002812) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002812) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002812) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002812) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001644) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001644) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001644) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001644) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001644) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001644) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001788) "7Ub6jZ95.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001788)38:Te984,"4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004080) "4f19dad06ea3f38e405559a2f7a7f7a6.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004080) "oX7Ko10.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003800) "oX7Ko10.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003800) "1bn64KB8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003908) "1bn64KB8.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003908) "2Kp5742.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetSChannelInterface (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter VaultFree (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter VaultCloseVault (UID: 00000000-00001024) "2Kp5742.exe" called "GetProcAddress" with a parameter VaultGetItem (UID: 00000000-00001024) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002812) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002812) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002812) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002812) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002812) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002812) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001644) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001644) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001788) "7Ub6jZ95.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001788)39:T1d2d,"CREATE TABLE sqlite_master(" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "create table sqlite_master(") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "CREATE TABLE" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "create table"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00001024.00000000.66844.0049C000.00000002.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE moz_annos ( id INTEGER PRIMARY KEY, place_id INTEGER NOT NULL, anno_attribute_id INTEGER, content LONGVARCHAR, flags INTEGER DEFAULT 0, expiration INTEGER DEFAULT 0, type INTEGER DEFAULT 0, dateAdded INTEGER DEFAULT 0, lastModified INTEGER DEFAULT 0)" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table moz_annos ( id integer primary key, place_id integer not null, anno_attribute_id integer, content longvarchar, flags integer default 0, expiration integer default 0, type integer default 0, dateadded integer default 0, lastmodified integer default 0)"), "CREATE TABLE moz_anno_attributes ( id INTEGER PRIMARY KEY, name VARCHAR(32) UNIQUE NOT NULL)E" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table moz_anno_attributes ( id integer primary key, name varchar(32) unique not null)e"), "CREATE TABLE sqlite_sequence(name,seq)" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table sqlite_sequence(name,seq)"), "CREATE TABLE moz_keywords ( id INTEGER PRIMARY KEY AUTOINCREMENT, keyword TEXT UNIQUE, place_id INTEGER, post_data TEXT)7" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table moz_keywords ( id integer primary key autoincrement, keyword text unique, place_id integer, post_data text)7"), "CREATE TABLE moz_bookmarks_deleted ( guid TEXT PRIMARY KEY, dateRemoved INTEGER NOT NULL DEFAULT 0)I" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table moz_bookmarks_deleted ( guid text primary key, dateremoved integer not null default 0)i"), "CREATE TABLE moz_bookmarks ( id INTEGER PRIMARY KEY, type INTEGER, fk INTEGER DEFAULT NULL, parent INTEGER, position INTEGER, title LONGVARCHAR, keyword_id INTEGER, folder_type TEXT, dateAdded INTEGER, lastModified INTEGER, guid TEXT, syncStatus INTEGER NOT NULL DEFAULT 0, syncChangeCounter INTEGER NOT NULL DEFAULT 1)" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table moz_bookmarks ( id integer primary key, type integer, fk integer default null, parent integer, position integer, title longvarchar, keyword_id integer, folder_type text, dateadded integer, lastmodified integer, guid text, syncstatus integer not null default 0, syncchangecounter integer not null default 1)"), "CREATE TABLE moz_hosts ( id INTEGER PRIMARY KEY, host TEXT NOT NULL UNIQUE, frecency INTEGER, typed INTEGER NOT NULL DEFAULT 0, prefix TEXT)1" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table moz_hosts ( id integer primary key, host text not null unique, frecency integer, typed integer not null default 0, prefix text)1"), "CREATE TABLE moz_inputhistory ( place_id INTEGER NOT NULL, input LONGVARCHAR NOT NULL, use_count INTEGER, PRIMARY KEY (place_id, input))?" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table moz_inputhistory ( place_id integer not null, input longvarchar not null, use_count integer, primary key (place_id, input))?"), "CREATE TABLE moz_places ( id INTEGER PRIMARY KEY, url LONGVARCHAR, title LONGVARCHAR, rev_host LONGVARCHAR, visit_count INTEGER DEFAULT 0, hidden INTEGER DEFAULT 0 NOT NULL, typed INTEGER DEFAULT 0 NOT NULL, frecency INTEGER DEFAULT -1 NOT NULL, last_visit_date INTEGER , guid TEXT, foreign_count INTEGER DEFAULT 0 NOT NULL, url_hash INTEGER DEFAULT 0 NOT NULL , description TEXT, preview_image_url TEXT)" (Source: 00000000-00001024.00000001.68281.00600000.00000004.mdmp, Indicator: "create table moz_places ( id integer primary key, url longvarchar, title longvarchar, rev_host longvarchar, visit_count integer default 0, hidden integer default 0 not null, typed integer default 0 not null, frecency integer default -1 not null, last_visit_date integer , guid text, foreign_count integer default 0 not null, url_hash integer default 0 not null , description text, preview_image_url text)"), "SELECT url FROM moz_places WHERE (`id` = 34)" (Source: 00000000-00001024.00000001.68281.01C40000.00000004.mdmp, Indicator: "select url from moz_places where (`id` = 34)"), "SELECT url FROM moz_places WHERE (`id` = 26)" (Source: 00000000-00001024.00000001.68281.01C40000.00000004.mdmp, Indicator: "select url from moz_places where (`id` = 26)"), "SELECT url FROM moz_places WHERE (`id` = 9)" (Source: 00000000-00001024.00000001.68281.01C40000.00000004.mdmp, Indicator: "select url from moz_places where (`id` = 9)")3a:T13f5,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00003800.00000ED8.797478.00050000.wprm") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigP" (Indicator: "CreateProcess"; Source: "00000000-00001024.00000000.66844.00510000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001024.00000000.66844.00510000.00000004.mdmp, 00000000-00001024.00000000.66844.005E0000.00000004.mdmp, 00000000-00001024.00000000.66844.00600000.00000004.mdmp, 00000000-00001024.00000000.66844.0065A000.00000004.mdmp, 00000000-00001024.00000001.68281.005E0000.00000004.mdmp, 00000000-00001024.00000001.68281.00600000.00000004.mdmp, 00000000-00001024.00000001.68281.01C40000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001024.00000000.66844.00600000.00000004.mdmp, 00000000-00001024.00000001.68281.00600000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001024.00000001.68281.01C40000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001788.00000000.68751.00160000.00000004.mdmp, 00000000-00001788.00000000.68751.00AC0000.00000004.mdmp, 00000000-00001788.00000000.68751.00E70000.00000004.mdmp, 00000000-00001788.00000000.68751.02430000.00000004.mdmp, 00000000-00001788.00000001.70672.00160000.00000004.mdmp, 00000000-00001788.00000001.70672.00AC0000.00000004.mdmp, 00000000-00001788.00000001.70672.00E70000.00000004.mdmp, 00000000-00001788.00000001.70672.01F70000.00000004.mdmp, 00000000-00001788.00000002.72598.00160000.00000004.mdmp, 00000000-00001788.00000002.72598.001B5000.00000040.mdmp, 00000000-00001788.00000002.72598.00AC0000.00000004.mdmp, 00000000-00001788.00000002.72598.00E70000.00000004.mdmp, 00000000-00001788.00000003.75560.00160000.00000004.mdmp, 00000000-00001788.00000003.75560.00AC0000.00000004.mdmp, 00000000-00001788.00000003.75560.00E70000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001788.00000000.68751.00160000.00000004.mdmp, 00000000-00001788.00000001.70672.00160000.00000004.mdmp, 00000000-00001788.00000002.72598.00160000.00000004.mdmp, 00000000-00001788.00000003.75560.00160000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00001788.00000000.68751.00160000.00000004.mdmp, 00000000-00001788.00000001.70672.00160000.00000004.mdmp, 00000000-00001788.00000002.72598.00160000.00000004.mdmp, 00000000-00001788.00000003.75560.00160000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001788.00000000.68751.001F7000.00000004.mdmp, 00000000-00001788.00000001.70672.001F7000.00000004.mdmp, 00000000-00001788.00000002.72598.001F7000.00000004.mdmp, 00000000-00001788.00000003.75560.001F7000.00000004.mdmp") Found reference to API "evateCreateProcess WRPMitig?" (Indicator: "CreateProcess"; Source: "00000000-00001788.00000000.68751.001F7000.00000004.mdmp, 00000000-00001788.00000001.70672.001F7000.00000004.mdmp, 00000000-00001788.00000002.72598.001F7000.00000004.mdmp, 00000000-00001788.00000003.75560.001F7000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003800.00000000.66161.002F0000.00000004.mdmp, 00000000-00003800.00000000.66161.01070000.00000004.mdmp, 00000000-00003800.00000001.68085.002F0000.00000004.mdmp, 00000000-00003800.00000001.68085.009A0000.00000004.mdmp, 00000000-00003800.00000002.68337.002F0000.00000004.mdmp, 00000000-00003800.00000002.68337.009A0000.00000004.mdmp, 00000000-00003800.00000002.68337.01070000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003800.00000000.66161.002F0000.00000004.mdmp, 00000000-00003800.00000001.68085.002F0000.00000004.mdmp, 00000000-00003800.00000002.68337.002F0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003800.00000000.66161.002F0000.00000004.mdmp, 00000000-00003800.00000001.68085.002F0000.00000004.mdmp, 00000000-00003800.00000002.68337.002F0000.00000004.mdmp")3b:T4fc,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "7Ub6jZ95.exe.513415986") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "7Ub6jZ95.exe.513415986") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "7Ub6jZ95.exe.513415986") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp")3c:T13e6f,Found reference to API (Indicator: "CheckTokenMembership"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "DecryptFileA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "FreeSid"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "EqualSid"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "RegCloseKey"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "FindNextFileA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "FindClose"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LocalAlloc"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "lstrcmpA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CompareStringA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetLastError"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "DeleteFileA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GlobalFree"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CloseHandle"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetProcAddress"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GlobalLock"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LocalFree"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "FreeLibrary"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "ReadFile"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SizeofResource"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "WriteFile"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetFileTime"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetFilePointer"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "FindResourceA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CreateMutexA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "FreeResource"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetVersion"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetTempPathA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CreateFileA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetEvent"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "TerminateThread"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetVersionExA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LockResource"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CreateThread"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "ResetEvent"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LoadResource"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "ExitProcess"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CreateProcessA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "FormatMessageA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CreateEventA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CharUpperA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "MessageBeep"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CharPrevA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LoadStringA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CharNextA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "EnableWindow"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "ReleaseDC"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "PeekMessageA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SendMessageA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "MessageBoxA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "ShowWindow"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetWindowPos"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetDC"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetWindowRect"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "Sleep"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "TerminateProcess"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetTickCount"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "MulDiv"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00001788.00000001.70672.00400000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "DecodePointer"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetActiveWindow"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetLastActivePopup"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetProcessWindowStation"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetFullPathNameW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetComputerNameA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetDateFormatW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "InterlockedIncrement"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "BackupSeek"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "TlsSetValue"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetCurrencyFormatW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "LoadLibraryW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetVersionExW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "CreateFileW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetVolumePathNameA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "CreateJobObjectA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "LCMapStringA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "InterlockedExchange"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "SetLastError"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetProcessHeaps"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "VirtualAlloc"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "BackupWrite"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "EnumDateFormatsExA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "SetComputerNameA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "OpenMutexA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "CreateFileMappingA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "CreateFileMappingW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "FindFirstVolumeMountPointW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "BeginUpdateResourceA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GlobalFindAtomW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "FindFirstChangeNotificationA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "VirtualProtect"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "OpenSemaphoreW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "FindAtomW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GlobalAddAtomW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "RegisterEventSourceW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetCommandLineA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetStartupInfoA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetStdHandle"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetCPInfo"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "InterlockedDecrement"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetACP"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetOEMCP"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "IsValidCodePage"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "TlsGetValue"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "TlsAlloc"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "TlsFree"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "HeapSize"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "HeapFree"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "IsDebuggerPresent"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "DeleteCriticalSection"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "LeaveCriticalSection"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "EnterCriticalSection"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "WideCharToMultiByte"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "SetHandleCount"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetFileType"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "HeapCreate"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "VirtualFree"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "MultiByteToWideChar"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "LCMapStringW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetStringTypeA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetStringTypeW"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetLocaleInfoA"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "HeapAlloc"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "HeapReAlloc"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "RtlUnwind"; File: "7Ub6jZ95.exe.513415986") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CredFree"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CredEnumerateA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentHwProfileA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevsA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetailA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RtlUnicodeStringToAnsiString"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp, 00000000-00001024.00000000.66844.0065A000.00000004.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00001024.00000001.68281.031E0000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000002.72598.001B5000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameExA"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp")3d:T44a,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeap"; File: "7Ub6jZ95.exe.513415986") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp")3e:T440,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "7Ub6jZ95.exe.513415986") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001024.00000000.66844.0049C000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001788.00000000.68751.00400000.00000040.mdmp, 00000000-00001788.00000001.70672.00260000.00000040.mdmp, 00000000-00001788.00000001.70672.00400000.00000040.mdmp, 00000000-00001788.00000003.75560.00400000.00000040.mdmp")3f:T5bf,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001024.00000000.66844.0065A000.00000004.mdmp 00000000-00001024.00000001.68281.00600000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001024.00000000.66844.0065A000.00000004.mdmp 00000000-00001024.00000001.68281.00600000.00000004.mdmp "sers\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "sers\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00001024.00000000.66844.0065A000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIALcNYHmp8nu6rs\Files\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\local\temp\granduialcnyhmp8nu6rs\files\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001024.00000001.68281.031E0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIALcNYHmp8nu6rs\Files\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\local\temp\granduialcnyhmp8nu6rs\files\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001024.00000001.68281.031E0000.00000004.mdmp40:T1dbe,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 4f19dad06ea3f38e405559a2f7a7f7a6.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: 4f19dad06ea3f38e405559a2f7a7f7a6.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 4f19dad06ea3f38e405559a2f7a7f7a6.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 4f19dad06ea3f38e405559a2f7a7f7a6.exe "System\CurrentControlSet\Control\Session Manager" in Source: 53274-17-0040256D "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001024.00000000.66844.00600000.00000004.mdmp 00000000-00001024.00000001.68281.00600000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001024.00000000.66844.00600000.00000004.mdmp 00000000-00001024.00000001.68281.00600000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001024.00000000.66844.00600000.00000004.mdmp 00000000-00001024.00000001.68281.00600000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001024.00000000.66844.00600000.00000004.mdmp 00000000-00001024.00000001.68281.00600000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001024.00000000.66844.0065A000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001024.00000001.68281.01C40000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7D9BDE7-2C35-4F7E-AEBE-9F3028451087}" in Source: 00000000-00001024.00000001.68281.031E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001024.00000001.68281.031E0000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001024.00000001.68281.031E0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001024.00000001.68281.031E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001788.00000000.68751.00400000.00000040.mdmp 00000000-00001788.00000001.70672.00260000.00000040.mdmp 00000000-00001788.00000001.70672.00400000.00000040.mdmp 00000000-00001788.00000003.75560.00400000.00000040.mdmp "alappdata%\Opera Software\Opera Neon\User Data" in Source: 00000000-00001788.00000001.70672.001F7000.00000004.mdmp 00000000-00001788.00000002.72598.001F7000.00000004.mdmp "%localappdata%\Opera Software\Opera Neon\User Data" in Source: 00000000-00001788.00000001.70672.001F7000.00000004.mdmp 00000000-00001788.00000002.72598.001F7000.00000004.mdmp "%localappdata%\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001788.00000001.70672.001F7000.00000004.mdmp 00000000-00001788.00000002.72598.001F7000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Local State" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ""p": "%appdata%\\Opera Software\\Opera Stable"," in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ""p": "%localappdata%\\Opera Software\\Opera Neon\\User Data"," in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ""p": "%appdata%\\Opera Software\\Opera GX Stable"," in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp ""p": "%localappdata%\\BraveSoftware\\Brave-Browser\\User Data"," in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp "%appdata%\Opera Software\Opera Stable" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp "era Software\Opera GX Stable" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp 00000000-00001788.00000003.75560.008A0000.00000004.mdmp "%appdata%\Opera Software\Opera GX Stable" in Source: 00000000-00001788.00000001.70672.008A0000.00000004.mdmp 00000000-00001788.00000002.72598.008A0000.00000004.mdmp "ocalappdata%\Opera Software\Opera Neon\User Data" in Source: 00000000-00001788.00000003.75560.001F7000.00000004.mdmp "ocalappdata%\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001788.00000003.75560.001F7000.00000004.mdmp "ppdata%\Opera Software\Opera Stable" in Source: 00000000-00001788.00000003.75560.008A0000.00000004.mdmp "ppdata%\Opera Software\Opera GX Stable" in Source: 00000000-00001788.00000003.75560.008A0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00001788.00000003.75560.02910000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Local State" in Source: 00000000-00001788.00000003.75560.02910000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00001788.00000003.75560.02910000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00001788.00000003.75560.02910000.00000004.mdmp41:T54b,"\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3056" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_bf0_IE_EarlyTabStart_0xdc8_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_bf0_ConnHashTable<3056>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_bf0_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_bf0_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "Local\ZonesLockedCacheCounterMutex" "IsoScope_bf0_ConnHashTable<3056>_HashTable_Mutex" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\VERMGMTBlockListFileMutex" "IsoScope_bf0_IESQMMUTEX_0_519" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3056" "Local\URLBLOCK_DOWNLOAD_MUTEX" "Local\ZonesCacheCounterMutex" "IsoScope_bf0_IE_EarlyTabStart_0xdc8_Mutex" "IsoScope_bf0_IESQMMUTEX_0_331"42:T697,"4f19dad06ea3f38e405559a2f7a7f7a6.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4f19dad06ea3f38e405559a2f7a7f7a6.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "oX7Ko10.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "oX7Ko10.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1bn64KB8.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1bn64KB8.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1bn64KB8.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "1bn64KB8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1bn64KB8.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "2Kp5742.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2Kp5742.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "7Ub6jZ95.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "7Ub6jZ95.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]43:T582,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "4f19dad06ea3f38e405559a2f7a7f7a6.exe") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "P1UU08OZ.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") file/memory contains long string with (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "function DynamicLink_PlayYouTubeVideoInline( elem, videoid )" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var youtubeurl = location.protocol + '//www.youtube.com/embed/' + videoid + '?showinfo=0&autohide=1&fs=1&hd=1&modestbranding=1&rel=0&showsearch=0&wmode=direct&autoplay=1';" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var wrapper = $J( '

', { 'class': 'dynamiclink_youtubeviewvideo' } );" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var embed_wrapper = $J( '

', { 'class' : 'dynamiclink_youtubeviewvideoembedded', 'frameborder' : '0' } );" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var iframeContent = $J( '